Definition
GitLost is a critical indirect prompt-injection vulnerability in github Agentic Workflows disclosed by noma-security on July 7, 2026. Unauthenticated attackers can exfiltrate private repository data by posting crafted issues in public repos when agents have cross-repo read permissions.
Key Points
- Attack vector: Indirect prompt injection via public issue title/body; no authentication required
- Mechanism: Agent reads hidden instructions, fetches private repo content (e.g., README), posts as public comment
- Guardrail bypass: Linguistic reframing (e.g., word “additionally”) reframed output constraints
- Affected: Agentic Workflows using Claude or github-copilot with org-wide read access
- Status (July 7): No CVE or official GitHub security advisory published; feature remains public preview
Related
- prompt-injection
- github
- noma-security
- ai-agent-security
- agentic-ai
- microsoft-execution-containers
- supply-chain-security