'GitLost': One Public GitHub Issue Can Leak Your Private Repos via AI Agents

Summary: Noma Security demonstrated that a concealed instruction in a public GitHub issue — triggered by the word "Additionally" — can cause GitHub's AI agent to access restricted files from private repositories and publish their contents in a public comment.

Key Facts

• Attack vector: Embed a hidden directive in a public issue on any repository the organization owns; the AI agent interprets it as a legitimate task instruction and follows it.
• Three conditions required: A public issue trigger, an agent with cross-repo read access inside the organization, and a permitted public output path (e.g., issue comments).
• No org membership needed: Any GitHub user can craft the malicious issue — no insider access required.
• Target feature: GitHub Agentic Workflows, launched February 2026, combine GitHub Actions automation with AI agents like Copilot and Claude.

Why It Matters

Classic prompt injection manipulates what a model says. GitLost manipulates what an agent does with its existing permissions — a fundamentally different threat model. Any organization granting AI agents cross-repository read access should immediately audit the agent's permission scope and restrict public output channels until GitHub issues a patch.

Read More

• Noma Security Research Post — Noma Security
• SecurityWeek Report — SecurityWeek