Threat · curated 7 Jul 2026
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
First reported · updated · 6 reports noma.security
Coverage timeline
Why it matters
GitLost shows that GitHub Agentic Workflows, a feature in public preview, can be weaponized by untrusted public content to exfiltrate private source code, exemplifying the lethal-trifecta risk in deployed agentic development tooling.
Noma Security researchers demonstrated GitLost, an indirect prompt injection technique that lets an attacker open a normal-looking public GitHub issue to steer GitHub Agentic Workflows into leaking the contents of an organization's private repositories into a public comment. The attack requires no stolen credentials or access, only that the organization's agent has read access across its repos.
Summary
Researchers at Noma Security demonstrated a technique they call GitLost that abuses GitHub Agentic Workflows through indirect prompt injection: an attacker who merely opens a normal-looking issue on a public repository — with no stolen credentials and no access to the target organization — can steer an AI agent into pulling private repository contents into a public comment.[0]
Exposure is limited to organizations that have enabled the GitHub Agentic Workflows public preview and wired an agent with cross-repository read access (including private repos) to act on untrusted public input while retaining the ability to post publicly. GitHub launched Agentic Workflows in a technical preview in February 2026, powered by GitHub Copilot, Anthropic's Claude, Google Gemini, or OpenAI Codex.[0][14]
The flaw fits Simon Willison's 'lethal trifecta' — an agent with access to private data, exposure to untrusted content, and a way to communicate externally — which the researchers and vendors characterize as an architectural limitation rather than a patchable bug. GitHub built guardrails for exactly this class of attack, yet Noma found a one-word change ('Additionally') slipped past its output threat-detection scan.[0][21]
Attack chain
- Setup / Preconditions: An organization enables the GitHub Agentic Workflows preview and grants a workflow agent a personal access token with read access across its repositories, including private ones, for cross-repo context. The workflow is configured to wake when an issue is assigned, read the issue, and reply with a comment.[0]
- Initial access via untrusted input: The attacker opens a normal-looking public issue containing malicious instructions — in Noma's proof of concept dressed up as a routine request from a VP of Sales after a customer meeting. No credentials or organizational access are required.[0]
- Indirect prompt injection: When a routine automation assigns the issue, the credentialed agent reads the attacker-controlled text and cannot reliably distinguish owner instructions from instructions embedded in content it processes, so it follows the injected instructions.[0][21]
- Guardrail bypass: GitHub's threat-detection step scans proposed agent output before posting, but Noma found a one-word change was enough to slip past: prefixing the malicious instruction with 'Additionally' led the model to treat it as a follow-on task rather than something to refuse.[0]
- Exfiltration: The agent pulls a private repository's README (or other content within the token's scope) and pastes it into a public comment on the issue, which becomes the data-exfiltration channel.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-05 | Invariant Labs showed that a public issue could push an agent connected to GitHub's MCP server into reading a private repo and leaking it through a pull request, describing the problem as architectural with no server-side patch.[0][22] |
| 2025-06-16 | Simon Willison publishes the 'lethal trifecta' framing (private data + untrusted content + external communication) later used by Noma to describe GitLost.[21] |
| 2026-02-13 | GitHub Agentic Workflows enter technical preview.[0][14] |
| 2026-07-07 | The Hacker News publishes coverage of Noma Security's GitLost technique; Noma disclosed the findings to GitHub and published with the company's knowledge.[0] |
How it works
The root weakness is indirect prompt injection: an AI agent cannot reliably tell the difference between instructions from its owner and instructions hidden inside the content it happens to read, so an attacker who writes instructions into an issue can get the agent to follow them. Everything gets glued into one token stream, and LLMs cannot reliably distinguish the importance of instructions based on their source.[0][21]
What distinguishes GitLost is that it manipulates what an agent does with its permissions rather than only what it says. The agent is a credentialed actor sitting inside CI/CD-adjacent infrastructure with read access spanning repos the attacker cannot see; it touches no server and needs no stolen credentials. Combining private-data access, untrusted input, and a public output channel produces a structural leak path with no clean data/instruction boundary as exists in SQL.[0]
GitHub's threat-detection step scans an agent's proposed output before it posts, but Noma showed a one-word change bypassed it: prefixing the malicious instruction with 'Additionally' led the model to treat it as a follow-on task rather than something to refuse, demonstrating the filter is a backstop, not a boundary.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| GitHub Agentic Workflows | Public/technical preview feature launched February 2026, when configured with an agent token holding cross-repository read access (including private repos), exposure to untrusted public input, and the ability to post public comments. | No patch; researchers and vendors classify the issue as an architectural limitation. Mitigation relies on scoped credentials, isolation, and staged human review rather than a code fix.[0][14] |
Key takeaways
- Any AI agent that can read private data, ingests untrusted external input, and can post publicly is one cleverly worded issue away from a data leak — the 'lethal trifecta' is the operative risk model, not a single patchable bug.[0][21]
- Guardrails like output threat-detection scanning are backstops, not boundaries: Noma bypassed GitHub's scan with a single-word prefix ('Additionally'), so defenders should rely on scoped credentials, isolation, and human review.[0]
- GitLost belongs to a recurring class of indirect prompt injection findings against agentic developer tooling (GitHub MCP server, Comment and Control, and earlier GitHub Action flaws), reinforcing that the problem is structural across vendors.[0][22][24]
Defensive actions
- Scope agent tokens to the single repository the workflow triages: Cross-repo access comes from a personal access token the organization sets up; a narrowly scoped token limits what an attacker can exfiltrate versus broad org-wide read access granted for convenience.[0]
- Limit what a public-facing workflow can post via declared safe outputs: Writes flow only through declared safe outputs, and the public comment the agent produces is the exfiltration channel, so restricting the output surface reduces the leak path.[0]
- Restrict which authors' content the agent acts on and gate outputs behind human review: Human review and author gating provide a boundary that a filter alone cannot, since Noma's one-word 'Additionally' bypass shows GitHub's threat-detection scan is a backstop, not a boundary.[0]
- Treat the issue as architectural: apply isolation, scoped credentials, and staged review: In natural language there is no clean data/instruction boundary as there is in SQL, so the fix leans on architecture rather than filtering the injection away.[0][21]