GitHub AI agent leaks private repos via prompt injection in public issues

Security researchers at Noma Labs discovered that GitHub's newly launched Agentic Workflows feature can be manipulated through prompt injection to expose private repository contents. By embedding hidden instructions inside a GitHub Issue, researchers tricked the AI agent into fetching README files from private repositories and posting them as public comments. No credentials or insider access were needed — the attack exploited the agent's inability to distinguish between legitimate operator instructions and malicious user-controlled input. GitHub had guardrails in place, but researchers found that simply adding the word 'Additionally' to the injected text was enough to bypass them entirely. Noma Labs responsibly disclosed the findings to GitHub and has published a live proof-of-concept, warning that prompt injection poses a structural, category-wide risk to agentic AI systems.