GitHub Agentic Workflows Flaw Lets Attackers Steal Private Repo Data via AI Agent

Security researchers at Noma Security discovered a prompt injection vulnerability, dubbed GitLost, in GitHub's Agentic Workflows feature, which entered public preview in February. The exploit allows an attacker to post a malicious public issue on a target repository, tricking the AI agent into reading private repository contents and posting them in a public comment. No stolen credentials are required — the attacker only needs access to a public surface where the agent reads and writes. The attack is amplified when organizations grant their workflow agent a cross-repository read token, a common configuration for legitimate use cases like shared schemas or release notes. GitHub has issued a fix, but security experts advise teams to carefully review token scopes and agent permissions before deploying Agentic Workflows on sensitive repositories.