GitHub AI Agentic Workflows Exposed by 'GitLost' Prompt‑Injection Flaw

Security researchers at Noma Security disclosed a critical prompt‑injection vulnerability in GitHub’s Agentic Workflows, dubbed “GitLost”. An unauthenticated attacker can open a single public issue in an organization’s repository and embed malicious instructions that the AI agent follows. Because the workflow agent is granted a token with read access to all repositories—including private ones—the agent retrieves files such as README .md from a private repo and posts their contents as a public comment. The exploit bypasses GitHub’s built‑in guardrails by prefixing the instruction with the word “Additionally”, causing the model to treat the request as a harmless follow‑up task.

The flaw affects the preview version of Agentic Workflows released in February and works with AI back‑ends such as GitHub Copilot, Anthropic Claude, Google Gemini and OpenAI Codex. No credentials, coding skill, or prior access to the target organization are required. Noma recommends that organizations limit the agent’s permissions, avoid granting broad repository‑read tokens, isolate user‑generated content from the instruction context, and require human verification for sensitive actions.

GitHub has not yet disclosed a patch, and the vulnerability highlights a broader risk that AI agents embedded in development pipelines can be weaponized through indirect prompt injection, similar to classic injection attacks on web applications.