Key Takeaways
- Noma Security’s “GitLost” proof-of-concept, disclosed in July 2026, demonstrated a prompt injection vulnerability in GitHub Agentic Workflows that could let unauthenticated attackers leak private repository data with no credentials required, though no confirmed real-world exploitation has been reported.
- The attack worked by embedding hidden instructions inside public GitHub issues; AI agents running on Claude or Copilot with org-wide read access would execute those instructions and post confidential data as public comments.
- Aikido Security’s response guidance treats the agent’s entire context window as an attack surface, recommending restricted toolsets, no untrusted input in prompts, and validation of all AI-generated output before execution. An unauthenticated attacker with no code skills could exfiltrate private repository data from a GitHub organisation just by writing a public issue. That is what Noma Security demonstrated in a July 2026 proof-of-concept called “GitLost”, a disclosed vulnerability in GitHub’s Agentic Workflows, not a confirmed real-world breach. No CVE or in-the-wild exploitation has been reported.
“GitLost” and the Attack Chain
GitHub’s Agentic Workflows let AI agents, including those powered by Claude or GitHub Copilot automate tasks inside GitHub Actions. GitLost exploited one of these workflows configured to trigger on issues.assigned events, read both the issue title and body, then post a comment in response. The workflow also carried read access to other repositories across the organisation, public and private alike.
The attacker’s move was simple: open a public issue on an org-owned repository and embed malicious instructions inside its body, written in plain English. Noma Security found that the keyword “Additionally” was enough to override the agent’s existing guardrails, compelling it to reframe its output. Instead of declining the instruction, the agent would pull data from private repositories and post it as a public comment on the original issue. No credentials, no exploit code, just text.
Prompt Injection as a Category Problem
The broader issue here is structural. Prompt injection in agentic systems works the same way SQL injection worked against early web applications: the system cannot distinguish between data it is supposed to process and instructions it is supposed to follow. Every piece of content an agent reads, whether a GitHub issue, a pull request comment, or a file, is also a potential instruction vector. Traditional security models enforce trust boundaries in code; agentic systems enforce them partly through model behaviour, which can be manipulated by anyone who can write to the agent’s context.
That is a harder problem than it sounds. Restricting what an agent can read limits its usefulness. Trusting everything it reads is what GitLost exploited. The attack surface is the context window itself, and that does not shrink as agents get more capable, it grows. Teams shipping agentic research workflows with broad repository access should treat this as a first-class architecture concern, not a post-launch security patch.
GitLost Was Not Alone
In December 2025, Aikido Security disclosed “PromptPwnd,” a prompt injection class affecting GitHub Actions and GitLab CI/CD pipelines when combined with agents such as Gemini CLI or Claude Code. According to Aikido Security, the flaw affected at least five Fortune 500 companies, allowing untrusted input to manipulate agents into leaking secrets or hijacking workflow execution.
A month earlier, in October 2025, Legit Security detailed “CamoLeak,” a vulnerability in GitHub Copilot Chat scoring CVSS 9.6. The flaw combined a Content Security Policy bypass with remote prompt injection to silently exfiltrate secrets and source code from private repositories and gave attackers full control over Copilot’s responses. Separately, as of February 2025, Lasso Security reported that Microsoft Copilot and Bing’s caching mechanism had exposed private GitHub repositories belonging to enterprises including IBM, Google and Microsoft itself through persistent cached data.
Rebuilding the Security Model for Agents
Noma Security’s core recommendation is direct: user-controlled content should never be treated as trusted instruction input for an AI agent. That means the workflow configuration itself, not the model’s judgement, must enforce what the agent can act on. Aikido Security’s remediation guidance goes further, advising teams to restrict the toolset available to agents, keep untrusted user input out of prompts entirely, and treat all AI-generated output as untrusted code that needs validation before execution.
Granular permissioning matters too. An agent that needs to read one repository has no business holding org-wide read access. GitLost worked partly because the affected workflow was over-provisioned. Least-privilege scoping at the workflow level, combined with agent-level defences against instruction injection is where the security posture needs to land. The attack surface is not going away; the question is whether teams architect around it before the next GitLost or after.
Originally published at https://autonainews.com/gitlost-prompt-injection-could-expose-private-github-repos-researchers-show/
Top comments (0)