GitLost: how a single GitHub Issue can make an AI agent leak private repositories

Researchers at Noma Security have discovered a new attack called GitLost, which targets GitHub Agentic Workflows. It turns out that merely opening a regular Issue in an organization's public repository can make an AI agent with access to its private repositories automatically extract their contents and post them in a public comment. The attacker doesn't need credentials or access to the company's infrastructure.

The vulnerability relies on indirect prompt injection: • the attacker creates a seemingly harmless GitHub Issue, with instructions for the AI agent hidden inside; • the agent interprets them as a legitimate task; • using its granted permissions, the agent reads private repositories; • the agent then publishes the extracted data in a public comment.

GitHub Agentic Workflows enable AI agents (Copilot, Claude, Gemini, Codex, etc.) to autonomously analyze Issues, use GitHub Actions tools, and operate across multiple repositories within an organization. If the agent's token allows access to private repositories, those privileges become the attack target. The problem doesn't stem from a bug in the GitHub platform, but from the combination of untrusted user input, overly broad agent privileges, and the ability to publish outputs in a public repository.

The authors showed that built‑in safeguards can be bypassed with minimal text tweaks. In their demo, adding just the word "Additionally" was enough for the agent to treat a malicious instruction as a continuation of a previous task and execute it despite the existing guardrails.

Article: https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/