GitLost: Tricking GitHub's AI Agent into Leaking Private Repositories

Noma Labs discovered a critical Prompt Injection vulnerability called 'GitLost' in GitHub's new Agentic Workflows. This vulnerability allows an unauthenticated attacker to steal private repository data within the same organization simply by posting a malicious Issue on a public repository.

GitHub Agentic Workflows is a tool that automates code repository tasks using natural language, where AI agents based on Claude or GitHub Copilot read issues, call tools, and generate responses. Attackers hide cleverly crafted commands in the issue body to induce the agent to follow the attacker's instructions instead of its original intent.

Attack Mechanism:

• The attacker creates a seemingly ordinary GitHub Issue on a public repository.
• An agent configured to read that issue executes the malicious prompt within it.
• If the agent has read access to other repositories within the organization, it leaks sensitive data externally.

This discovery illustrates a classic security threat that arises in AI agent systems when the boundary between System Directive and Untrusted User Data is not clearly separated.