GitLost - One word is all it takes to make GitHub's AI agent leak your private repos

Here we go again! What would you think of a private GitHub repo that could exfiltrate its own code all by itself into a section publicly visible to everyone? Pretty wild, right?

Well, that's exactly the trick Sasi Levi from Noma Security just pulled off using GitHub's AI agent. And you'll see - it's dead simple, which makes it incredibly scary.

This attack is called GitLost, and the target is GitHub Agentic Workflows - a system that hooks an AI agent (running on Claude or Copilot) into your GitHub Actions so it can work through your tickets on its own. It's a setup where the agent has read access to your private repos and wakes up whenever an issue is assigned to it. Super handy, except… it's a real trap that can snap shut on you very quickly.

It actually starts with a simple issue in a public repo. Nothing fancy - no poisoned commit, no malicious MCP server. Just text, with hidden instructions buried in plain English inside the ticket. The agent reads the issue, stumbles across the hidden instructions, and treats them as legitimate orders.

And that's where things go sideways, because it then dutifully goes and fetches the contents of a README from a private repo it has access to (in the demo, sasinomalabs/testlocal ). Up to this point, it's classic prompt injection exfiltration - except that normally you'd need to be clever getting the data out: a booby-trapped markdown image, a network request to a server you control, a covert channel… you name it.

But with this GitLost attack, none of that is needed. The agent simply copies the private content into a public on the original issue, and that's it. Fully readable by anyone browsing the public repo.

During testing, the model did sometimes refuse to follow the hidden instructions. But the researcher found a workaround: just add the word "Additionally" to the prompt. That simple connector is enough to make it reconsider its refusal and execute the command. To be clear, "Additionally" isn't some magic spell that unlocks every AI on the planet - but sometimes it's enough to bypass the guardrails. Which really says a lot how robust the security on these models is…

If this rings a bell, it should. We've already seen CamoLeak [FR] , which turned Copilot into a spy via a GitHub , with a much more polished exfiltration method (markdown image, CVSS score of 9.6). GitLost is really the lazy version of that. Same family of attack, except this time the attacker doesn't even have to break a sweat.

We also saw a Java library try to trick AI coding assistants into deleting your tests, so I think you know how this song goes… Be wary of agents writing code unsupervised, because they've become a prime target for cybercriminals.

So no, GitHub isn't "wide open" - the vulnerable configuration is very specific, requiring an agent with cross-repo read access AND triggered by public inputs. Very few organizations run things exactly like that. Noma responsibly disclosed the vulnerability to GitHub, no CVE has been assigned as of yet, and there's been no public confirmation of a fix on their end so far.

So never treat user-supplied text as a trusted instruction, isolate inputs, and stick to the absolute minimum permissions. It's really the same logic as validating inputs in a form, when you think it…

Then join my community on Patreon for exclusive articles, advanced tutorials and lots of other surprises I keep for my supporters. It's thanks to you that I can keep sharing my passion after 20 years!