'GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows

The flaw allows an unauthenticated attacker to craft a GitHub Issue in an org's public repository and then silently pull data from its private repos, too.

A critical prompt injection flaw in GitHub Agentic Workflows allows attackers to trick AI-powered automation into leaking data from an organization's private code repositories, all without compromising an account or exploiting software vulnerabilities.

Using the flaw, dubbed "GitLost" by the researchers from Noma Security who discovered it, an unauthenticated attacker can craft a GitHub Issue in a public repository belonging to an organization, and then silently pull data from its private repositories, too, according to a report published Tuesday.

GitHub Agentic Workflows pairs GitHub Actions — the platform's automation system for running tasks in response to repository events — with an AI agent backed by Claude or GitHub Copilot to help developer teams manage their GitHub workflows. The tool lets teams automate their interactions with code repositories using natural language, and the GitHub agent can read issues, call tools, and access other repositories within an organization.

"GitLost perfectly illustrates one of the fundamental security challenges every organization faces with agentic AI systems," Sasi Levi, security research lead at Noma, wrote in the report. "The agent's context window is also its attack surface. Any content the agent reads, whether issues, pull requests, , or files, can be weaponized if the agent treats that content as instructional input."

This scenario paved the way for what has now become a common attack vector in agentic AI systems: prompt injection , which is the nature of the flaw that Noma discovered and exploited via a proof of concept (PoC) exploit.

The vulnerable Github Agentic Workflow was configured to do the following: trigger the workflow on "issues.assigned" events in GitHub; read the issue Title and Body; post a in response using the add- tool; and run with read access to other repositories (public and private) in the organization. The PoC developed by Noma that exploits this workflow resulted in exposure of an organization's private data regarding a meeting that employees had.

The PoC demonstrates how a threat actor can create a GitHub Issue and, in the issue body, hide commands in plain English that GitHub's agent will follow, according to the report. An attacker needs no coding skills, access, or credentials to exploit the flaw — they only have to open an issue in a public repository belonging to an organization that uses GitHub’s Agentic Workflow setup, and then wait.

"In most agentic prompt injection attacks, the agent treats the wrong content as a trusted source of instructions and allows itself to be misdirected or misused," Levi wrote. "This happens when the system fails to maintain a strict trust boundary between system-level directives and untrusted user data."

Indeed, the vulnerability demonstrates that threat actors only "need to hide plain-English commands within content to trick a highly permissioned AI into bypassing its own guardrails and silently handing over private intellectual property," Jason Soroko, senior fellow at certificate life cycle management provider Sectigo, tells Dark Reading.

Noma said it responsibly disclosed the flaw to GitHub, which did not immediately respond to Dark Reading's request for on whether the flaw has been addressed. GitHub told Noma it updated the documentation creating the flaw and the last time the researchers checked, it was not there, according to Noma.

While the emergence of agentic developer tools has certainly helped accelerate the work of development teams in an unprecedented way, the use of natural language in these tools also has introduced a security gap that exposes a "critical paradigm shift in cybersecurity," Soroko says.

"As development teams rapidly adopt agentic AI workflows, the fundamental architecture of trust is changing," he says. While traditional automation relies on rigid, code-enforced boundaries, the use of natural language seamlessly blending system instructions with untrusted user data within the same context window, Soroko observes.

In fact, GitLost is a great example of a class of vulnerabilities that security researchers repeatedly warn , Levi tells Dark Reading. "That's a strong signal this isn't a one-off implementation slip in a single feature; it's a structural consequence of giving AI agents standing credentials while also having them process attacker-reachable text."

This security issue requires a response from defenders to navigate the emerging threat landscape . To do this, Soroko suggests they adopt a zero-trust approach toward the data their AI agents consume.

"Organizations should immediately audit their existing AI workflow configurations to enforce the strict principle of least privilege, stripping agents of unnecessary cross-repository access and heavily restricting their ability to post internal data publicly," he says.

Developers also must fundamentally change how they build these systems by logically isolating untrusted user input from core system prompts, and stop treating user-generated text as trusted instructions, Soroko says.

Noma also cautioned defenders to never treat user-controlled content as trusted instruction input for an AI agent and to keep permissions to the required minimum, as "agents with cross-repository access are especially high-value targets" for attackers.

Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician.

The State of Cloud Security: The Latest Challenges

The total economic impact™ of Snyk

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Securing the AI Era: Shadow AI, AI Agents, and Why AI Detection and Response Changes Everything

Practical Zero Trust Implementation on a Budget in the Age of Mythos

Building a Risk Based Vulnerability Management Program

Threat Hunting That Gets Big Results Despite Small Budgets

Say Yes to AI: Securing Innovation Without Compromise