GitHub Agentic Workflows Left Vulnerable to Data Leaks via “GitLost” Flaw
A critical flaw in GitHub’s Agentic Workflows has been discovered, allowing attackers to trick AI-powered automation into leaking sensitive data from private code repositories without compromising accounts or exploiting software vulnerabilities. Dubbed “GitLost,” the vulnerability was found by researchers at Noma Security and can be exploited by an unauthenticated attacker to silently pull data from private repositories.
The flaw arises from the way GitHub Agentic Workflows pair GitHub Actions, a platform for running tasks in response to repository events, with an AI agent backed by Claude or GitHub Copilot. This tool enables developer teams to automate interactions with code repositories using natural language, but also introduces a security risk when the agent reads and acts on untrusted user data.
The vulnerable workflow is triggered by “issues.assigned” events in GitHub, which then allows an attacker to read the issue title and body, post comments in response, and run with read access to other repositories within the organization. In a proof-of-concept exploit developed by Noma, the vulnerability was demonstrated by exposing an organization’s private data regarding a meeting that employees had attended.
The “GitLost” flaw highlights a critical security challenge faced by organizations using agentic AI systems: the agent’s context window is also its attack surface. Any content read by the agent can be weaponized if it treats that content as instructional input, paving the way for prompt injection attacks. This scenario has become increasingly common in agentic AI systems, which rely on natural language inputs to perform tasks.
Prompt injection attacks involve hiding commands in plain English within user-generated content that an AI system will follow. In this case, an attacker only needs to create a GitHub Issue with hidden commands in the issue body, and then wait for the agent to act on them. This can be done without any coding skills, access, or credentials.
The emergence of agentic developer tools has undoubtedly accelerated development teams’ work, but it also introduces new security risks. As Soroko from Sectigo points out, the use of natural language in these tools creates a “critical paradigm shift in cybersecurity” that exposes organizations to data leaks and other threats.
While GitHub has not immediately responded to our request for comment on whether the flaw has been addressed, Noma reports that the company updated its documentation creating the vulnerability. This highlights the importance of responsible disclosure and collaboration between security researchers and vendors to address emerging threats.
As development teams continue to rapidly adopt agentic AI workflows, it’s essential to acknowledge the changing architecture of trust in these systems. Organizations must be aware of the risks introduced by natural language inputs and take steps to mitigate them, including implementing strict trust boundaries between system-level directives and untrusted user data.
Ultimately, the “GitLost” flaw serves as a reminder that agentic AI systems are not foolproof and can be exploited if not properly secured. By understanding the potential risks and taking proactive measures, organizations can minimize their exposure to these threats and ensure the security of their sensitive data.
Source: Dark Reading — 2026-07-07