GitLost Attack: Public GitHub Issue Tricks AI Agents Into Leaking Private Repo Data

Researchers at Noma Security have demonstrated a novel prompt injection attack, dubbed GitLost, that exploits GitHub Agentic Workflows to leak private repository data. The attack requires no stolen credentials or access to the target organization; an attacker only needs to open a seemingly normal issue on a public repository. If the organization has granted the AI agent read access across its repositories—including private ones—the malicious issue can trick the agent into pulling private contents into a public comment.

GitHub Agentic Workflows, launched in February 2026, allow users to write instructions for AI agents in plain English within Markdown files. These agents can be powered by GitHub Copilot, Anthropic’s Claude, Google Gemini, or OpenAI Codex. While workflows are read-only by default, organizations can provide a token with cross-repo read access for convenience, which GitLost exploits.

The attack leverages indirect prompt injection, where an AI agent cannot distinguish between instructions from its owner and those hidden in content it reads. In Noma’s proof of concept, a malicious issue disguised as a routine request from a VP of Sales caused the agent to read a private repository’s README and paste it into a public comment. GitHub’s guardrails, including sandboxing, read-only tokens, input cleaning, and threat detection, were bypassed with a single word change—prefixing the malicious instruction with “Additionally” made the model treat it as a follow-on task.

What sets GitLost apart is that it manipulates what an agent does with its permissions, not just what it says. The agent acts as a credentialed actor inside CI/CD-adjacent infrastructure with read access to private repos. This fits the “lethal trifecta” concept: an agent that can reach private data, takes in untrusted content, and has a way to send data out. The attack is structural, not a simple bug, and similar to previous vulnerabilities in Anthropic’s Claude Code, Orca Security’s RoguePilot, and Invariant Labs’ MCP server attack.

To mitigate, organizations should scope tokens to single repositories, limit what public-facing workflows can post, restrict which authors’ content agents act on, and gate outputs behind human review. GitHub’s threat detection is a backstop, not a boundary, as demonstrated by the one-word bypass.