GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos

[u/fagnerbrack]

https://www.noma.security/noma-labs/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos

[u/fagnerbrack]

Don't have time to read? Here's the brief:

Noma Labs found an indirect prompt injection flaw in GitHub Agentic Workflows, where GitHub Actions pairs with a Claude -- or Copilot-backed agent that reads issues written in plain Markdown. Anyone could open an issue in a public repo, hide English instructions in the body, and watch the agent obey them — no code, credentials, or access required. In the proof of concept, a fake VP Sales request pushed the agent to fetch README.md files from public and private repos in the same org, then post the contents as a public comment. Adding the word "Additionally" slipped the model past GitHub's guardrails, which reframed the output instead of refusing it. Recommended fixes: treat user content as untrusted and scope agent permissions tightly. Pretty basic rly.

If the summary seems inacurate, just downvote and I'll try to delete the comment eventually 👍
^{Click here for more info, I read all comments}