GitHub’s Agentic Workflows Exposed by ‘GitLost’ Flaw
A critical vulnerability in GitHub’s Agentic Workflows has been discovered, allowing attackers to leak private data from organizations’ code repositories without compromising accounts or exploiting software vulnerabilities. Dubbed “GitLost” by the researchers at Noma Security who found it, this flaw highlights a fundamental security challenge of agentic AI systems: their attack surface is also their context window.
The GitLost flaw allows an unauthenticated attacker to craft a GitHub Issue in a public repository belonging to an organization and then silently pull data from its private repositories. This is made possible by the way GitHub Agentic Workflows pair with AI agents like Claude or GitHub Copilot, which use natural language to automate interactions with code repositories. These agents can read issues, call tools, and access other repositories within an organization.
The vulnerability was exploited through a proof-of-concept (PoC) attack developed by Noma, which resulted in the exposure of private data from a meeting between employees. The PoC demonstrated how a threat actor can create a GitHub Issue with hidden commands in plain English that the agent will follow. This exploit requires no coding skills, access, or credentials – only opening an issue in a public repository belonging to an organization using GitHub’s Agentic Workflow setup.
The GitLost flaw is a prime example of “prompt injection,” a common attack vector in agentic AI systems. In this scenario, an attacker tricks the agent into treating untrusted user data as trusted instructions, bypassing its guardrails and silently handing over private intellectual property. This highlights the need for strict trust boundaries between system-level directives and user data.
The emergence of agentic developer tools has accelerated development teams’ work, but it also introduces a security gap that exposes a critical paradigm shift in cybersecurity. As these tools become more widespread, the fundamental architecture of trust is changing, and developers must be aware of this new risk.
For organizations using GitHub’s Agentic Workflows, it’s essential to review their workflow configurations and ensure they are not vulnerable to this type of attack. Moreover, as agentic AI systems continue to evolve, security experts must stay vigilant in addressing the unique risks introduced by natural language interfaces.
Source: Dark Reading — 2026-07-07