Noma Labs has exposed a critical prompt injection vulnerability in GitHub’s Agentic Workflows, dubbed GitLost, that allows unauthenticated attackers to silently extract private repository data.

Noma Labs discovered a prompt injection vulnerability in GitHub's newly launched Agentic Workflows, named GitLost, which allows an unauthenticated attacker to silently pull private repository data by posting a crafted GitHub issue in a public repository belonging to the same organization. By exploiting agent workflows configured to trigger on issue events (like assignment), attackers can instruct the underlying AI agent to fetch files from private repositories and post them as public comments. Despite existing guardrails, researchers found that adding the keyword "Additionally" to their injected prompts caused the model to reframe its output and bypass restrictions, highlighting the fragility of relying on model behavior to enforce security boundaries.