GitHub AI agent leaks private repositories via prompt injection attack

Noma Security researchers discovered a vulnerability named GitLost affecting GitHub’s preview Agentic Workflows. Through a prompt injection attack, unauthenticated users can submit crafted GitHub issues to public repositories to trick the AI agent. If the agent possesses read access to private repositories within the same organization, it can retrieve sensitive code and publish it in public comments. Currently, there is no code fix, and GitHub has not yet documented this specific security flaw.