Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

Noma Security's "GitLost" PoC shows that a crafted public GitHub issue can perform indirect prompt injection against GitHub Agentic Workflows that hold organization-wide read tokens, causing the agent to pull private repository contents and paste them into a public comment; the report explains the attack flow, why it is an architectural limitation, prior similar incidents, and recommends mitigation such as scoping tokens, limiting outputs, and human review.