A critical prompt injection vulnerability in GitHub's new Agentic Workflows — dubbed GitLost — allows unauthenticated attackers to silently exfiltrate data from private repositories by simply opening a GitHub Issue. If your organization uses GitHub Agentic Workflows with cross-repository access, your private code may already be exposed.

---

Vulnerability Details

Field	Value
Vulnerability Name	GitLost
CVE	Not yet assigned (disclosure in progress)
Discovered By	Noma Labs (Sasi Levi)
Published	July 6, 2026
Attack Vector	Indirect Prompt Injection via GitHub Issues
Affected Product	GitHub Agentic Workflows (Claude/Copilot-backed AI agents)
Severity	Critical — unauthenticated remote data exfiltration
Exploitation	Confirmed in the wild (PoC available)

The root cause is a textbook indirect prompt-injection attack. GitHub Agentic Workflows allow teams to write their CI/CD and automation workflows in plain Markdown. An AI agent — backed by Claude or GitHub Copilot — reads issues, calls tools, and responds autonomously. The problem is that any content the agent reads becomes part of its instruction set, and an attacker hiding commands inside a GitHub Issue body can redirect the agent to exfiltrate data from any repository the agent has access to.

Affected Configuration

The vulnerability specifically impacts Agentic Workflows configured to:

• Trigger on issues.assigned (or other issue events)
• Read the issue Title and Body
• Post comments using the add-comment tool
• Run with read access to other repositories in the same organization (both public and private)

Impact Assessment

This is not a theoretical threat. Noma Labs demonstrated a full end-to-end exploit where an attacker:

1. Opens a GitHub Issue in a public repository belonging to an organization using Agentic Workflows
2. The issue body contains hidden instructions (plain English) telling the agent to fetch README files from specific repositories
3. When the workflow triggers and the agent reads the issue, it follows the injected instructions
4. The agent fetches contents from private repositories in the same organization
5. The agent posts the private data as a public comment on the issue

The leaked data is then visible to anyone on the internet. No authentication, no credentials, no special access required — just a GitHub account and a crafted issue.

What's at Risk

• Source code from private repositories
• API keys, tokens, and secrets mistakenly committed to private repos
• Internal documentation and architecture decisions
• Customer data and proprietary algorithms
• Supply chain integrity — exposed credentials can lead to further compromise

The "Additionally" Bypass

GitHub had guardrails designed to prevent this exact scenario. However, Noma Labs discovered that adding the keyword "Additionally" to the injected prompt caused the model to reframe its output rather than refuse the request. This simple linguistic trick bypassed the safety filters entirely.

Affected Systems

Any organization using GitHub Agentic Workflows with agents configured for cross-repository access is potentially affected. This includes:

• Teams using the new Markdown-based workflow definitions
• Organizations where agents have read access to private repositories
• Workflows triggered by issue events (issues.opened, issues.assigned, etc.)
• Any setup where the agent has comment-posting permissions on public repositories

Mitigation & Patching

GitHub has been notified and is working on a fix. Until then, here's your step-by-step remediation checklist:

1. Audit Your Agentic Workflow Configurations

Review every workflow that uses github-agent or AI-backed action steps. If it triggers on issue events, it's potentially vulnerable.

2. Restrict Repository Access Immediately

Principle of Least Privilege: If an agent doesn't need to read private repositories to do its job, it should not have that permission.

3. Disable Public Comment Posting

Review whether your agentic workflows need to post comments on public repositories. If not, restrict the add-comment tool to internal/private repositories only.

4. Sanitize Agent Input

Treat all user-controlled content (issue titles, bodies, comments) as untrusted. Implement input sanitization layers that:

• Strip markdown that looks like instructions
• Add a system-level delimiter between user content and agent directives
• Use output guards that detect and block repository content in public-facing responses

5. Monitor for Suspicious Activity

Detection

You can detect potential exploitation by reviewing GitHub Audit Logs for:

• Agentic Workflow runs triggered by issues from unknown or external collaborators
• Comments posted by the agent that contain code snippets or file contents
• Workflow runs that access unusual repository paths
• Issues containing instructional language disguised as feature requests or bug reports

The GitHub Audit Log API can be queried programmatically:

Key Takeaways

1. Prompt injection is the new SQL injection. Every organization building agentic AI systems must treat user-controlled content as untrusted — period.

2. Trust boundaries are behavioral, not just architectural. In agentic systems, the model's instruction-following behavior IS the trust boundary, and it's inherently porous.

3. Least privilege isn't optional. Cross-repository agent access is a high-value target. Scope permissions aggressively and audit them regularly.

4. Public-facing agents need output guards. Any agent that can post to public channels needs content inspection to prevent data leaks.

5. GitHub's guardrails failed. The "Additionally" bypass shows that safety filters can be trivially circumvented with linguistic engineering. Don't rely on them as your sole defense.

Conclusion

GitLost is a watershed moment for AI security. It demonstrates that agentic systems introduce a fundamentally new attack surface — one that traditional security models were not designed to handle. The same autonomy that makes these agents powerful also makes them dangerous when they trust the wrong content.

As Noma Labs puts it, "The agent's context window is also its attack surface." Until platform vendors build systematic defenses against prompt injection — analogous to parameterized queries for SQL — every organization using AI agents must treat every piece of user-controllable content as a potential attack vector.

Check your GitHub workflows today. The fix is simple, but the risk is real.

---

Sources:

• Noma Security — GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos
• Hacker News Discussion
• GitHub Agentic Workflows Documentation