GitLost Flaw Shows How a Public GitHub Issue Can Expose Private Repositories Through AI Agents

Quick Facts

• Noma Security disclosed a vulnerability called GitLost that lets a public GitHub issue steer AI agentic workflows into exposing private repository contents without any stolen credentials.
• A one-word prefix in the malicious prompt was enough to bypass GitHub’s built-in threat-detection guardrail during Noma’s proof-of-concept test.
• Exposure is limited to organizations that have enabled GitHub Agentic Workflows in preview and granted their agent read access to private repositories while also accepting untrusted public input.

Researchers at Noma Security have demonstrated that a public GitHub issue can trick GitHub’s AI-powered agentic workflows into pasting private repository contents into a public comment. The company disclosed the technique, which it calls GitLost, to GitHub and published its findings on July 7 with GitHub’s knowledge.

GitHub Agentic Workflows entered public preview after a technical preview launch on February 13, 2026. The feature lets developers write automation instructions in plain-English Markdown files. An agent then reads issues and pull requests, runs tools, and replies without manual intervention. It supports GitHub Copilot, Anthropic’s Claude, Google Gemini, and OpenAI Codex as backends.

The attack requires no stolen credentials and no write access to any private resource. An attacker only needs to open a public issue on a public repository belonging to an organization that has given its agent an org-wide read token.

How It Works

The underlying weakness is indirect prompt injection. An AI agent cannot reliably distinguish between instructions from its operator and instructions embedded in content it reads during a task. GitLost exploits that gap.

In Noma’s proof of concept, researchers crafted an issue disguised as a routine request from a VP of Sales following a customer meeting. Once standard automation assigned the issue to the agent, the agent read the issue, followed the embedded instructions, pulled a private repository’s README, and posted it as a public comment.

GitHub built a threat-detection step specifically to scan proposed outputs before the agent posts them. Noma reported that prefixing the malicious instruction with the word “Additionally” caused the model to treat it as a follow-on task rather than a suspicious command. The guardrail let it through.

Noma Security Research Lead Sasi Levi described the conditions as a “lethal trifecta,” a term coined by developer Simon Willison: an agent that can access private data, reads untrusted outside content, and has a channel to send data out. All three conditions existed in the tested configuration.

“Earlier prompt injection examples were largely about manipulating what an agent said,” Levi said. “GitLost is about manipulating what an agent does with its permissions.”

What Can Be Exposed

The scope of a leak depends entirely on what the agent’s token can read. Depending on how broadly an organization has scoped its token, that could include proprietary source code, internal documentation, design files, or CI/CD secrets.

Levi noted that token scope is the most important variable. An agent token scoped to the single repository it triages is “far less dangerous than one issued broad org-wide read access” for convenience.

GitHub’s Defenses and Their Limits

GitHub designed several layers of protection into Agentic Workflows. Agents run read-only by default inside a sandboxed Docker container. An Agent Workflow Firewall routes all outbound traffic through a proxy and enforces a domain allowlist. A dedicated threat-detection job scans proposed changes before they are applied.

GitLost shows those infrastructure-level controls did not stop an attack operating at the model-behavior level. The bypass happened not through a network exploit but through a single word that changed how the model classified an instruction.

A Pattern, Not an Isolated Case

GitLost follows a series of related disclosures. Orca Security’s RoguePilot used a hidden prompt in a GitHub issue to make Copilot leak a repository’s privileged token. A flaw in Anthropic’s Claude Code GitHub Action let a malicious issue push the agent into leaking secrets and taking write access. Invariant Labs showed in May 2025 that a public issue could push an agent connected to GitHub’s MCP server into leaking a private repo through a pull request.

For founders and executives running engineering teams on GitHub, the practical response is straightforward. Audit what read access your agentic workflow tokens carry. If an agent only needs to triage issues in one repository, its token should not reach others. Broad org-wide tokens handed to agents that read public input are the direct prerequisite for this class of attack.

Read more: GitLost vulnerability let GitHub’s AI workflows leak private repositories