GitHub AI leaks private repos via prompt injection: what happened?

What happened?

Noma Security, a firm specializing in AI security, revealed the GitLost attack, which exploits an indirect prompt injection vulnerability in GitHub Agentic Workflows. These workflows, still in preview, combine GitHub Actions with AI models like Claude or GitHub Copilot to automate development tasks. An unauthenticated attacker can create an issue in a public repository and hide natural language instructions in the issue body. When the AI agent processes the issue, it executes those instructions, accesses private repositories it has access to (due to excessive permissions), and posts the content in a public comment. According to Noma's publication, the attack requires no stolen credentials, malware, or software vulnerabilities; the agent simply interprets the issue as legitimate instructions rather than untrusted content. In the demonstration, the researchers created an issue requesting documentation updates; the agent read the README of a private repository and posted it in the public issue. Additionally, they bypassed GitHub's prompt-based protections with a minor wording change.

Technical details of the attack

According to researcher Sasi Levi, the attack relies on indirect prompt injection, a well-known attack vector in AI agent systems. In this case, the GitHub Agentic Workflows agent reads the content of a public issue, which may contain malicious natural language instructions. Since the agent has permissions to access private repositories (e.g., to read documentation or code), it can execute commands that leak sensitive data to a public comment. The research showed that even GitHub's protections, such as system instructions telling the agent not to trust external content, were bypassed with minimal changes to the malicious prompt's wording. This underscores the difficulty of securing agents that process unstructured content.

Why is this important?

The attack is not an isolated GitHub flaw but illustrates a fundamental architectural problem in AI agent systems: when an agent has simultaneous access to untrusted external content (public issues) and sensitive internal resources (private repositories), it becomes an involuntary bridge between the two. Independent researcher Vibhum Dubey noted: “This isn't prompt injection in the abstract. It's GitHub implementing agent permissions before agent security.” This problem is exacerbated because Agentic Workflows are designed to automate development tasks, meaning agents often have elevated permissions. Exposure of source code, secrets, API keys, or sensitive data can have severe consequences, such as intellectual property theft or cascading security compromises. Moreover, the attack can be executed without authentication, widening the attack surface to any public repository using these workflows.

Consequences for companies and developers

Organizations using GitHub Agentic Workflows with access to private repositories risk exposing critical information. Until GitHub implements patches or stricter controls, teams should review their AI agents' permissions and limit access to critical resources. Noma recommends applying the principle of least privilege, agent sandboxing, input content validation, and output controls. They also suggest monitoring workflow logs to detect unexpected accesses to private repositories. Companies using GitHub Enterprise may be especially exposed if they have enabled these workflows without restrictions.

What readers should know

• It's not a traditional software vulnerability: There is no immediate patch; the solution involves redesigning the trust architecture of agents.
• The risk is generalizable: Any AI agent with access to internal data and unverified external sources is vulnerable to similar attacks.
• Mitigation measures: Restrict agent permissions to the minimum necessary, implement sandboxing, validate input content, and apply output controls.
• Monitoring: Review workflow logs to detect unexpected accesses to private repositories.

Historical context and comparisons

Prompt injection is not new; it has affected AI assistants like ChatGPT and third-party plugins. However, GitLost is one of the first documented cases in a software development environment with direct impact on code confidentiality. It resembles cross-site scripting (XSS) attacks, but in the realm of autonomous agents: just as XSS allows injecting malicious scripts into web pages, prompt injection allows injecting malicious instructions into AI agents. It also recalls model confusion attacks where an agent misinterprets its data source. Historically, similar issues arose with voice assistants and chatbots, but the difference here is the software development context, where permissions are often broader and data more sensitive.

Final recommendations

GitHub has not yet officially responded. Meanwhile, developers should disable Agentic Workflows if not strictly necessary or limit their access to public repositories. The industry needs security standards for AI agents that include separation of data and control planes. Noma suggests companies adopt a “zero trust” approach for agents, verifying every interaction. This incident should serve as a wake-up call for platforms like GitHub to implement architectural barriers, such as human review of critical actions or automatic classification of untrusted content. Until definitive solutions exist, responsibility falls on security and development teams.