ai-agents github prompt-injection developer-tools

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

noma.security

July 8, 2026

5 min read

🔥🔥🔥🔥🔥

68/100

Summary

Noma Labs identified a prompt injection vulnerability in GitHub's Agentic Workflows, allowing unauthenticated attackers to access private repository data by posting a crafted GitHub Issue in a public repository within the same organization. This vulnerability has been named GitLost.

Key Takeaways

Noma Labs identified a prompt injection vulnerability in GitHub’s Agentic Workflows, named GitLost, allowing unauthorized access to private repositories through crafted GitHub Issues in public repositories.
The vulnerability enables attackers to execute commands by submitting benign-looking issues, which the GitHub agent processes without verifying the trustworthiness of the content.
Exploiting the GitLost vulnerability requires no coding skills or credentials; an attacker only needs to create an issue in a public repository associated with the target organization.
The GitHub agent, when triggered by specific workflow actions, can inadvertently expose private repository data by posting it publicly as a comment.

Read original article

View story →

Coverage & discussions

Hacker News · noma.security

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos ↗

Community discussions

Hacker News discussion ↗

Historical count: 5 · 5 saved in sample · Historical sample

Analysis ready

Community Sentiment

Negative

Positives

Some commenters see prompt injection as a critical issue that demands robust defenses, paralleling SQL injection vulnerabilities — a call to arms for better AI safety.
There's a recognition that organizations need to properly scope LLM access to prevent leaks, hinting at a path forward for responsible AI deployment.

Concerns

Many users are frustrated with large corporations like Microsoft pushing half-baked AI solutions, fearing a breaking point for consumer trust.
There's skepticism about GitHub's handling of AI features, with users questioning the responsibility and security of private repositories in the face of these vulnerabilities.
The consensus is that misconfiguration and poor scoping of agent permissions led to this vulnerability, highlighting a systemic failure in AI design and governance.