GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

The GitLost vulnerability is a textbook example of prompt injection in AI agent systems. Attackers exploit the trust that GitHub Agentic Workflows place in user-provided content by hiding malicious instructions within the body of an issue. When the agent reads the issue and performs actions, it follows these instructions rather than the operator's intent.

Specifically, the workflow is configured to trigger when an issue is assigned. The agent reads the issue title and body, uses the add-comment tool to reply, and is granted read access to other repositories within the organization, including private ones. An attacker only needs to create an issue in a public repository belonging to the same organization and wait for the agent to execute.

Noma Labs researchers demonstrated the full attack: They created a seemingly normal issue simulating a customer request from a VP of Sales. After the issue was automatically assigned, the event triggered the workflow. The agent retrieved the README.md files from both a public repository (poc) and a private repository (testlocal) and posted their contents as a public comment on the issue, viewable by anyone.

The attack requires no coding skills, access rights, or credentials. The researchers provided reproducible evidence, including workflow run logs (actions/runs/23909666039) and the issue link (issues/153), which contained the leaked private data.

GitHub had guardrails in place intended to prevent such leaks, but the researchers found that adding the keyword 'Additionally' triggered unexpected model behavior, causing it to reorganize its output instead of denying the request. This linguistic trick caused the agent to ignore the intended refusal policy and successfully bypass security restrictions.

This reveals a security flaw at the behavioral level of AI models: Traditional security models enforce trust boundaries through code, whereas AI systems' trust boundaries are partly determined by model behavior. Models are inherently trained to follow instructions, making prompt injection attacks a systemic vulnerability class.

GitLost perfectly illustrates a fundamental security challenge of AI agent systems: The agent's context window is the attack surface. Any content the agent reads—issues, PRs, files, etc.—can be weaponized if the agent treats it as an instruction input. This parallels the impact of SQL injection on web applications and requires systematic defense strategies.

Noma Labs recommends: Never treat user-controlled content as trusted instructions; minimize permission scopes, especially cross-repository read access; limit agents' ability to publicly post content; and isolate or sanitize user input before passing it to the model. These measures are critical for building secure AI agent systems.