GitHub AI agent vulnerable to prompt injection attack

According to a study by Noma Security, a prompt injection attack can trick the beta version of GitHub's Agentic Workflows into extracting content from private repositories and publishing it publicly. The attack, named GitLost, was detailed in a blog post by the AI security firm. Noma explains that an unauthenticated attacker could exploit the preview version by submitting a specially crafted GitHub issue to a public repository. If the AI agent has read access to private repositories within the same organization, it can extract sensitive information and post it in a public comment. The Agentic Workflows combine GitHub Actions with AI models like Claude or GitHub Copilot, allowing developers to define workflows in Markdown. The attack did not rely on stolen credentials, malware, or software flaws; instead, hidden instructions were embedded in a GitHub issue. The researchers demonstrated the attack by creating a seemingly normal issue, and the AI agent fetched a README from a private repository and posted it publicly. They also bypassed GitHub's prompt-based safety measures with slight wording changes. GitHub did not respond to requests for comment. Noma notes that GitLost highlights a broader architectural challenge for AI agents: any agent with access to untrusted external content and sensitive internal resources can become an unintentional bridge between them if trust boundaries are not respected. Security researcher Vibhum Dubey argues that the issue is not just prompt injection but that GitHub grants permissions to agents before ensuring their safety, operating on a service-account authorization model rather than a user model. Dubey recommends explicit whitelists for repositories, validating all user inputs before they reach the LLM, and having an emergency stop mechanism.