Researchers at Noma Security Inc. disclosed a critical prompt injection vulnerability in GitHub’s Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code repositories by posting a single crafted issue in a public one.
Vulnerability details
Name: GitLost
Target: GitHub Agentic Workflows — AI automation feature where workflows live in plain Markdown and compile to GitHub Actions. Behind them sits an AI agent running on Anthropic’s Claude or GitHub Copilot that reads incoming issues and acts without human sign-off.
Attack vector: Indirect prompt injection. An attacker buries hostile instructions in content the agent reads; the model follows them as operator instructions. No coding skill or account on the target required — attacker opens an issue in a public repository owned by an organization running a vulnerable workflow.
Proof of concept
Noma tested a workflow configured to trigger on issue assignment, read issue title/body, post a comment, and run with read access to other public and private repositories in the organization. Hidden in a plausible sales-executive request were plain-English commands.
Once GitHub automation assigned the issue, the agent fetched README files from public and private repositories and posted them as a public comment readable by anyone on the internet.
Guardrail bypass
GitHub had guardrails meant to stop exfiltration, but Noma defeated them by adding the word “additionally” to injected instructions, causing the model to reframe output rather than refuse. The technique echoes Noma’s April “GrafanaGhost” research where specific keywords tricked models into processing blocked instructions.
Expert commentary
Mariano Fuentes, co-founder of Comp AI: “If you don’t properly limit its tools and capabilities, it can rapidly execute instructions from a malicious party without you ever knowing. The attacker can prompt the LLM to not verbally acknowledge what it’s going to do and therefore it silently executes the instructions without the victim ever knowing.”
Structural problem
The agent’s context window doubles as its attack surface. Any issue, pull request, comment, or file the agent reads can be weaponized. Noma argues prompt injection has become to agentic AI what SQL injection was to web applications.
Recommendations
- Never treat user-controlled content as trusted instruction input
- Scope agent permissions to minimum required
- Restrict what agents can post publicly
- Isolate user input from instruction context before it reaches the model
- Require human verification for sensitive actions
GitLost was responsibly disclosed to GitHub and detailed publicly with the company’s knowledge.