GitLost Vulnerability Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos

A critical vulnerability known as “GitLost” has been discovered in GitHub’s newly introduced Agentic Workflows by Noma Labs. This flaw allows unauthenticated attackers to exfiltrate sensitive data from private repositories.

It demonstrates how AI-driven automation within development pipelines can be manipulated to bypass conventional access controls and leak confidential information across repository boundaries.

GitLost Vulnerability

GitHub Agentic Workflows combine GitHub Actions with AI agents, such as those powered by models like Claude or GitHub Copilot. This setup allows workflows to be created in natural language using Markdown. These AI agents can read issues, execute tasks, interact with repositories, and automatically post responses.

While this design aims to enhance developer productivity, it also introduces a new attack surface that allows untrusted inputs to manipulate agent behavior.

According to research from Noma Labs, the root cause of the GitLost vulnerability stems from a classic indirect prompt injection scenario. The GitHub agent fails to establish a strict trust boundary between system-level instructions and user-controlled input.

Attackers can exploit this flaw by embedding malicious instructions within the body of a GitHub Issue. When the agent processes the issue, these hidden instructions can override the intended workflow logic and trigger unauthorized actions.

The vulnerability discovered by researchers involved workflows triggered by issue assignment events. The agent was set up to read issue content, utilize tools such as “add-comment,” and operate with read access to both public and private repositories within the same organization. This configuration proved dangerous, as it allowed external attackers to query sensitive internal data without authentication indirectly.

The attack chain is notably simple and does not require technical expertise. An attacker creates what appears to be a legitimate issue in a public repository belonging to a target organization. Once the issue is assigned—either manually or through automation—the workflow is activated.

The agent then processes the issue content, executes the injected instructions, retrieves data from accessible repositories, and posts the extracted information as a public comment. In Noma’s proof-of-concept, this included content from private repository files, such as README.md, effectively exposing internal project data.

Researchers also identified a technique for bypassing guardrails through subtle prompt phrasing. By inserting keywords such as “Additionally,” the model’s safety mechanisms were circumvented, leading it to comply with malicious instructions rather than reject them. This demonstrates the fragility of current AI alignment and filtering approaches when exposed to adversarial inputs.

The GitLost vulnerability highlights a broader systemic risk in agentic AI systems. Unlike traditional software, which enforces trust boundaries through deterministic logic, AI agents rely on probabilistic interpretations of instructions.

This makes them inherently vulnerable to manipulation through carefully crafted inputs. As organizations increasingly adopt AI-powered automation, prompt injection is emerging as a class of vulnerabilities comparable to SQL injection in web applications.

Noma Labs recommends enforcing strict separation between trusted instructions and user input, minimizing agent permissions, restricting public outputs, and implementing robust input sanitization.

GitHub has been notified through responsible disclosure, and these findings underscore the urgent need for secure design patterns in AI-integrated development workflows.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN