Well documentedThree or more independent publishers report the core facts.
GitHub Agentic Workflows Vulnerable to Prompt Injection, Leaking Private Repositories
Researchers discovered a prompt injection vulnerability in GitHub Agentic Workflows that allows attackers to create a malicious public issue to trick the AI agent into leaking an organization's private repository contents. The attack requires no credentials or special access, only the organization's agent having read access to its repositories.
Researchers at Noma Security discovered a vulnerability dubbed 'GitLost' in GitHub Agentic Workflows that allows attackers to trick the AI agent into leaking private repository contents.
An attacker can open a normal-looking issue on a public repository, with no stolen credentials or access to the organization, to cause the agent to leak private repository data if the organization has granted the agent read access across its repositories.
Reported impact
The vulnerability exposes an organization's private repository contents to the public internet through exploitation of GitHub Agentic Workflows.
Index analysis
The vulnerability results from the AI agent's susceptibility to prompt injection attacks embedded in public GitHub issues that manipulate the agent into accessing and disclosing private repositories.