GitLost Vulnerability Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos

Noma Labs discovered “GitLost,” a critical prompt‑injection vulnerability in GitHub Agentic Workflows that can be triggered by creating and assigning a malicious issue; AI agents reading the issue can be manipulated to execute hidden instructions, access private repositories, and post extracted data publicly. The report includes a proof‑of‑concept exfiltrating private README content, describes a guardrail bypass technique, and recommends strict trust boundaries, least privilege for agents, output restrictions, and input sanitization; GitHub was responsibly notified.