Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data

GitLost is an indirect prompt-injection exploit discovered by Noma Security that targets GitHub's Agentic Workflows. Attackers plant concealed instructions inside public GitHub issues so that when the AI agent processes those issues, it can be steered into leaking private repository data. The findings were reported by Sergio De Simone for InfoQ.

Technically, the attack is indirect: the malicious payload lives in content the agent is expected to read, not in a direct chat prompt. When Agentic Workflows pick up a public issue, the hidden instructions can override or slip past intended safeguards and cause the agent to surface confidential material in public comments, where it is visible outside the private repo boundary.

For engineers and builders, this matters because agentic tooling often holds broader repo access than a human commenter would exercise in a single issue thread. Any workflow that lets an AI agent read private code, secrets, or internal docs while also writing to public surfaces creates a cross-boundary channel that classic issue moderation does not fully cover.

In market terms, GitHub is pushing Agentic Workflows as part of the broader race to put coding agents inside existing developer platforms. GitLost shows that the same product surface that makes agents useful on real repositories also expands the attack surface: public issue text becomes an untrusted input channel into privileged automation, not just a human discussion feed.

The practical takeaway is to treat public issues, PR text, and other untrusted repo content as hostile input whenever an agent can act on them with private context. Teams should review which Agentic Workflows can read private data and write publicly, constrain those permissions tightly, and watch for follow-on hardening from GitHub and for similar indirect injection patterns in other coding-agent products that bridge public signals and private repositories.