Noma Labs, the research arm of Noma Security, disclosed on July 7 a critical vulnerability dubbed "GitLost" in GitHub's new Agentic Workflows feature that lets an attacker post a single public issue to manipulate its AI agent into publicly leaking data from private repositories within the same organization.
July 7, 2026 · Noma Labs
"GitLost": One Public Issue Can Leak Your Private Repositories
A vulnerability in GitHub's AI Agentic Workflows lets an attacker plant hidden instructions in a single crafted Issue — no authentication, no coding — tricking an AI agent into exposing a private repo's contents as a public comment.
1
public Issue is enough to trigger the leak
1
word — "Additionally" — bypasses the guardrail
0
authentication or coding skills required
How the attack flows
STEP 1
Attacker posts a natural-sounding Issue on a public repo, hiding instructions in the body
→
STEP 2
An event (e.g. assignment) triggers the AI agent, which reads the Issue as instructions
→
STEP 3
Agent fetches a private repo's README and posts its contents as a public comment
Indirect prompt injection: commands are planted in user content the AI ingests — the agent's context window itself becomes the attack surface.
Attack conditions
Issue-posting rights on a public repo (anonymous possible)
Target: private repos in the same Organization
Feature is in Public Preview (started Feb 2026)
Recommended mitigations
Separate user input from instruction context
Minimize tools and permissions granted to agents
Restrict public posting; enforce human review
The bigger picture
For agentic AI that autonomously executes tools, prompt injection is emerging as a systemic vulnerability class — much like SQL injection before it.
GitHub received a responsible disclosure and was aware of the issue at publication; the feature remains in Public Preview.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…