Noma Security’s research team disclosed GitLost, a critical prompt injection vulnerability in GitHub Agentic Workflows.
An attacker can trick GitHub’s AI agent into retrieving data from a private repository and posting it publicly by submitting a crafted issue in a public repository belonging to the same organization.
No stolen credentials or direct organization access are required. The attack exploits indirect prompt injection — hostile instructions buried in issue content that the agent treats as legitimate operator commands.
GitHub Agentic Workflows pair GitHub Actions with an AI agent running on Claude or GitHub Copilot. Workflows are defined in Markdown and compile to Actions YAML.
Mitigation guidance: review agent permissions, especially read access spanning public and private repositories within an organization. As of disclosure date, no CVE or official GitHub security advisory was published.