GitLost Vulnerability Tricks GitHub’s AI Agent into Leaking Private Repos

Cybersecuritynews •Guru Baran • July 7, 2026

A newly disclosed vulnerability dubbed “GitLost” shows how attackers can weaponize a single GitHub Issue to trick GitHub’s new AI-powered Agentic Workflows into leaking private repository contents to the public internet, with no credentials, coding skills, or system access required. GitHub Agentic Workflows pair GitHub Actions with an AI agent backed by Claude or GitHub […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New GitHub Exploit Allows AI Coding Agents to Execute Malicious Payloads Researchers from Mozilla's 0DIN have demonstrated a new attack vector that allows AI coding agents, specifically Anthropic's Claude Code, to execute malicious payloads from seemingly benign GitHub repositories. The attack exploits the agent's automated error recovery process, where it runs initialization commands without human oversight. This method involves three steps: a Python package requiring initialization, a command that runs a script, and a DNS TXT record controlled by the attacker that retrieves and executes a payload. Notably, no malicious code exists in the cloned repository, making detection by security scanners and human reviewers nearly impossible. The attack grants the attacker a shell with the developer's privileges, allowing access to sensitive data such as environment variables and API keys. Although currently a proof-of-concept, the method poses a significant risk to developers using automated coding tools. The researchers recommend treating automated initialization steps as untrusted execution and implementing explicit human approval gates. No active exploitation has been reported yet. 67 sources 62

Extracted Entities

GitLost Vulnerability Tricks GitHub’s AI Agent into Leaking Private Repos

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)

Vulnerabilities (1)