Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

Researchers at Noma Security discovered a technique called GitLost that exploits indirect prompt injection to manipulate GitHub Agentic Workflows into leaking private repository data. The attack involves a malicious public GitHub issue that tricks an AI agent with read access into pulling and publicly commenting sensitive contents from private repositories. This highlights an architectural risk in AI agents that combine access to private data, untrusted input, and public output channels, creating a data exfiltration path without requiring stolen credentials or direct access.

AI-extracted · verify before operational use