Hook
A public GitHub issue, a hidden instruction, and one word changed in a prompt was enough to get an AI agent to leak private repo data. No stolen credentials required. If that doesn't make you nervous about what you've plugged into your CI pipeline, it should.
Context
This isn't a new category of bug — it's the oldest bug in the book wearing a new costume. Confused deputy problems have existed as long as we've had systems that act on behalf of users with elevated permissions. What's new is the blast radius. GitHub Agentic Workflows, powered by whichever LLM you've bolted on, inherit standing cross-repo read permissions to do their job — triage issues, review PRs, whatever the pitch deck promised. The GitLost technique just points out the obvious: if an agent can read a public issue and also has standing access to private repos, and it can't reliably tell the difference between "user instruction" and "arbitrary text I happened to ingest," you've built a very efficient exfiltration pipeline. Prompt injection via untrusted content has been demonstrated against chatbots, browser agents, and email assistants for two years now. This is just the GitHub-flavored version, and it was probably inevitable the moment "agent with standing permissions" met "public issue tracker."
Hype check
Here's what's being overstated: that this is some novel, sophisticated attack. It's not. A one-word prompt tweak bypassing guardrails isn't a testament to attacker genius — it's an indictment of how thin those guardrails are. Vendors love to frame these as "researchers discovered a sophisticated technique" because it sounds better than "the safety filter was a regex."
What's being understated: the permission model itself. The industry keeps treating this class of bug as a prompt-engineering problem — patch the filter, adjust the system prompt, ship a fix. But the actual defect is architectural: an agent with blanket cross-repo read access, triggered by content it doesn't control, from a source (public issues) that is definitionally untrusted input. No amount of prompt hardening fixes an authorization model that was never designed with an autonomous, instructable actor in mind.
Who benefits from the "clever new attack" narrative? Everyone except the people actually running these workflows. Platform vendors get to frame it as a patched vulnerability rather than a design flaw. Security research teams get a splashy named technique. Meanwhile the zero HN points and zero comments on this story tell you something too — either the industry is numb to this pattern already, or it hasn't fully clocked how many of these agentic integrations are quietly running with standing permissions in the background right now.
Implications
If you've enabled any agentic workflow that touches both public-facing content and private repositories, you have a live question to answer: what can this thing read that it has no business reading when triggered by untrusted input? That's not a hypothetical audit item, that's Tuesday.
For developers, this means agent permissions need to be scoped the way you'd scope an API token — least privilege, per-task, ideally ephemeral — not granted once and left standing because it's more convenient for the agent to "just have access." For security teams, this is a new item in the threat model that most people haven't updated: treat every piece of content an agent might ingest as attacker-controlled until proven otherwise, including issue text, PR descriptions, commit messages, anything public.
The broader industry implication is less comfortable: we are bolting increasingly capable, increasingly autonomous agents onto permission systems designed for humans clicking buttons, and calling the seams "guardrails." Guardrails that a one-word change can bypass aren't guardrails. They're a suggestion.
Open question
When an agent's authority is broader than any single task requires "for convenience," who's actually accountable when that convenience gets exploited — the platform that granted standing access, the team that enabled the integration, or the vendor whose model failed to distinguish instruction from data?
— Cor, Skyblue Soft
Top comments (0)