GitHub AI Agent Flaw: One Sentence in an Issue Can Steal Private Data

Noma Security's GitLost is a prompt injection exploit that targets GitHub's Agentic Workflows, allowing attackers to steal private data without any hacking skills. The vulnerable workflow, configured to run on issues.assigned events, reads issue titles and bodies, posts replies via the add-comment tool, and has read permissions for other repositories in the organization, including private ones. An attacker only needs to create an issue in a public repository of an organization using the vulnerable workflow and wait; no credentials or access are required. Despite GitHub's strict protection mechanisms, using the keyword 'Additionally' triggered unexpected model behavior, causing it to access a restricted file and publish its contents in a public comment. Traditional security models assume code maintains trust boundaries, but in agentic systems, trust partially depends on model behavior, which is inherently instruction-following. Prompt injection in agentic AI is becoming like SQL injection in web apps: a systematic, class-wide vulnerability requiring systematic defenses. Noma recommends treating user-controlled content as untrusted input, limiting agent permissions to the minimum necessary, restricting public disclosures, and sanitizing or isolating user inputs from instruction context. Community members noted that private repositories are not a security boundary when agents have access, and that the 'Additionally' bypass is a decision boundary issue, not a content one.