A nasty prompt injection vulnerability in GitHub Agentic Workflows could let unauthenticated attackers siphon data from private repositories. No credentials needed. No coding skills required.
Security firm Noma Labs found the flaw, which they’ve named GitLost. Here’s how it works: GitHub Agentic Workflows lets users write workflows in plain English using markdown files. An AI agent then executes those instructions as GitHub Actions. The problem is, that agent can be tricked.
Attackers can hide malicious prompts inside crafted GitHub Issues on a public repository. If that repository belongs to an organization that also maintains private repos, and the agent has read access to those, the attacker’s instructions get followed. The agent fetches private data and posts it publicly.
Noma demonstrated the attack by crafting a GitHub Issue that looked like a request from sales leadership. The agent dutifully grabbed Readme.md files from both public and private repos and posted them as a public comment.
GitHub does have guardrails. But Noma found they failed when researchers added the keyword “additionally” to their prompts.
“The agent’s context window is also its attack surface,” Noma warned. “Any content the agent reads, whether issues, pull requests, comments, or files, can be weaponized.”
Noma disclosed the finding to GitHub responsibly. They recommend treating all user-controlled content as untrusted, restricting agent permissions, and sanitizing input before it reaches AI agents.
