Recent research has uncovered a vulnerability in GitHub’s Agentic Workflows that could allow attackers to extract sensitive information from private repositories. This exploit, termed ‘GitLost’ by Noma Security, leverages indirect prompt injection to manipulate AI agents into disclosing confidential data.
GitHub’s Agentic Workflows, introduced in February 2026, enable developers to automate tasks using AI agents by providing instructions in plain English within Markdown files. These agents can process issues and pull requests, execute tools, and generate responses autonomously. They are compatible with AI models such as GitHub Copilot, Anthropic’s Claude, Google Gemini, and OpenAI Codex. By default, these workflows have read-only access, but organizations can grant them broader permissions, including access to private repositories, to enhance their functionality.
The GitLost attack exploits this expanded access. An attacker can create a seemingly innocuous issue in a public repository. If the organization’s Agentic Workflow is configured to read and respond to such issues and has been granted access to private repositories, the AI agent can be tricked into retrieving and publicly disclosing private content. This is achieved by embedding malicious instructions within the issue, which the AI agent interprets and acts upon, leading to unintended data exposure.
GitHub has implemented safeguards to mitigate such risks, including sandboxing, default read-only tokens, input sanitization, and threat detection mechanisms that review an agent’s output before publication. However, Noma Security’s proof-of-concept demonstrated that minor modifications, such as prefixing a malicious instruction with ‘Additionally,’ can bypass these defenses, causing the AI agent to execute unauthorized actions.
This vulnerability underscores the challenges associated with integrating AI agents into development workflows. While these agents offer significant automation benefits, they also introduce new security considerations. Organizations must carefully evaluate the permissions granted to AI agents and implement robust monitoring to detect and prevent potential abuses. As AI continues to play a larger role in software development, ensuring the security of these systems becomes paramount to protect sensitive information and maintain trust in automated processes.
