Bug tricks GitHub AI agent into leaking

Security researcher Sasi Levi at Noma Security disclosed a prompt-injection vulnerability, named GitLost, affecting GitHub’s Agentic Workflows on July 6. An unauthenticated attacker could post a crafted GitHub Issue containing hidden instructions in a public repository; once the AI agent was triggered by the issues.assigned event, it followed those instructions and silently exfiltrated content from private repositories in the same organization, including posting private README contents publicly.

Noma’s writeup highlights an odd detail in how the guardrails were bypassed: reframing the malicious instruction with the word “Additionally”, turning what looked like a request extension rather than a new command, was enough to get the agent to comply instead of refusing. The team demonstrated the exploit against a real test organization and repository, with documented workflow runs showing the exfiltration happening end to end.

This is the latest in a run of disclosures showing that AI coding agents wired into CI/CD-adjacent triggers, issue creation, PR comments, webhook events, inherit whatever access the underlying automation has, and that access is often broader than the agent’s intended task requires. GitHub has not yet published a fix timeline as of this writing.

If you’ve wired an AI agent to act on GitHub Issues, PR comments, or any other user-writable input, the concrete step is to check what that agent’s credentials can actually reach, repos, secrets, deploy keys, and scope it down to only what the specific automation needs, rather than trusting that issue text can’t carry executable instructions.