GitLost: Prompt Injection in GitHub's Agentic Workflows Leaks Private Repos

Noma Labs found that GitHub’s newly launched Agentic Workflows — which pair GitHub Actions with a Claude- or Copilot-backed AI agent that reads issues and calls tools autonomously — can be hijacked through indirect prompt injection. An attacker with no credentials or code access simply opens an issue in any public repository belonging to a target organization. Instructions hidden in plain English inside the issue body are then executed by the agent as if they were legitimate operator commands. In the demonstrated exploit, a benign-looking issue framed as a request from a VP of Sales caused the agent to pull the README contents of both public and private repositories in the organization and post them as a public comment, exposing private data to anyone on the internet.

The dubbed-GitLost flaw hinges on the agent granting cross-repository read access and failing to keep a trust boundary between system directives and untrusted user input. GitHub had guardrails meant to block exactly this behavior, but the researchers bypassed them by prepending the word ‘Additionally’ to their payload, nudging the model to reframe the output rather than refuse it. Noma published live proof-of-concept runs and issues showing the leaked data.

The finding underscores a structural problem with agentic AI: the model’s context window is also its attack surface, and any content it ingests — issues, comments, pull requests, files — becomes potential instruction input. Noma likens prompt injection to what SQL injection was for web apps: a whole category of systemic risk. Their mitigations are the familiar least-privilege playbook — never trust user-controlled content as instructions, scope agent permissions tightly, restrict what agents can post publicly, and isolate or sanitize user input before it reaches the model. The issue was responsibly disclosed to GitHub.