Introduction

GitHub recently launched GitHub Agentic Workflows, pairing GitHub Actions with an AI agent backed by Claude or GitHub Copilot. However, Noma Labs discovered a critical prompt injection vulnerability within this system, allowing an unauthenticated attacker to silently pull data from private repositories [1]. The vulnerability, named GitLost, highlights the security challenges of agentic AI systems.

What are GitHub Agentic Workflows?

GitHub Agentic Workflows let teams automate their interactions with code repositories using natural language. Workflows live in Markdown (.md) files, are compiled into YAML files, and run with the help of an AI agent with configurable permissions [2].

GitLost Vulnerability Overview

The root cause of the GitLost vulnerability is prompt injection, a class of attack in which an adversary hides malicious instructions inside the content read by an AI agent [3]. In this specific case, any malicious actor can create a GitHub Issue and, in the issue body, hide commands in plain English that GitHub's agent will follow.

The Attack Flow

To exploit this vulnerability, the attacker needed no coding skills, access, or credentials. All that was needed was to open an issue in a public repository belonging to an organization that uses GitHub's Agentic Workflow setup and wait [4].

Why it Matters

GitLost perfectly illustrates one of the fundamental security challenges every organization faces with agentic AI systems. The agent's context window is also its attack surface. Any content the agent reads, whether issues, pull requests, comments, or files, can be weaponized if the agent treats that content as instructional input [5].

Noma Recommendations for Builders/AI Security Officers:

  • Never treat user-controlled content as trusted instruction input for an AI agent
  • Scope permissions to the minimum required. Agents with cross-repository access are especially high-value targets
  • Restrict what any agent can post publicly, especially in response to issue content
  • Sanitize or isolate user input from the instruction context before passing it to the model

Sources

  1. https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/
  2. https://noma.security/blog/thats-a-great-question-claude-tag-and-agent-identity-what-changes-for-iam/
  3. https://korben.info/en/gitlost-github-ai-agent-private-repo-leak.html
  4. https://news.ycombinator.com/item?id=48827858
  5. https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/