Researchers say GitHub’s AI-powered Agentic Workflows can be tricked into exposing private repository contents in public comments, putting organizations that mix public and private repos at risk. Noma Labs calls the issue GitLost and says an attacker only needs to open a crafted issue in a public repository within the same GitHub organization; the agent can then fetch data from a private repo and post it publicly. No CVE or complete fix was reported, and GitHub had not added documentation-based mitigations as of publication.
Why it matters: Organizations using GitHub’s autonomous coding and workflow agents may be exposing internal code or secrets without realizing it. Security teams should review any Agentic Workflows permissions and repository access paths immediately, especially where public issue creation can trigger agents with access to private repos.
Ionut Arghire
2026.07.08
98% relevant
This is the same underlying event: the GitLost prompt-injection issue in GitHub Agentic Workflows. The article adds exploit details, including that a crafted public GitHub issue can trigger on issues.assigned events, that the workflow may have read access across an organization’s public and private repositories, and that researchers bypassed guardrails with phrasing variations such as adding the word “additionally.”
2026.07.07
100% relevant
This article appears to be the first concrete reporting here on the GitLost prompt-injection issue affecting GitHub Agentic Workflows, including exploitation details, impact, and the lack of a vendor fix or mitigation guidance.
← Back to all stories