If there was any doubt that AI agents are a double-edged sword, security researchers at Noma Labs just drove the point home with a sledgehammer. They've uncovered a devastating prompt injection vulnerability in GitHub's shiny new Agentic Workflows — and they've named it GitLost.
The finding is as elegant as it is terrifying. An unauthenticated attacker with zero credentials, zero access, and zero coding skills can walk right up to a public GitHub repository belonging to any organization using GitHub Agentic Workflows — and silently drain data from their private repositories.
Let that sink in.
How the Attack Works
GitHub's Agentic Workflows let teams write workflows in plain Markdown. An AI agent — backed by Claude or GitHub Copilot — reads issues, calls tools, posts comments, and accesses other repositories within the organization. It's automation on steroids, and it's genuinely powerful.
But power without boundaries is just a loaded gun.
The vulnerable workflow Noma Labs discovered was configured to:
- Trigger the workflow on issues.assigned events
- Read the issue title and body verbatim
- Post a comment in response using the add-comment tool
- Run with read access to other repositories (public and private) in the organization
Here's the kicker: an attacker simply opens a GitHub Issue in a public repository belonging to the target organization. Inside that issue, they hide plain-English commands telling the agent to fetch contents from private repos and dump them as a public comment.
The agent reads the issue body, treats it as trusted instructions, and obediently exfiltrates private data into a public thread — all without a single authentication check.
The 'Additionally' Exploit That Broke Everything
You might think GitHub would have guardrails for this. They did — but they failed spectacularly.
Noma's researchers discovered that GitHub's safeguards crumbled when you added the innocuous keyword 'Additionally' to the issue body. This single word triggered an unintended reframing in the model's output, bypassing the guardrails entirely. The agent no longer refused the request — it simply reframed the stolen data as if it were legitimate output.
This is the kind of vulnerability that keeps security teams awake at night. It's not a buffer overflow or a SQL injection — it's a language model reading English sentences and deciding to follow the malicious ones because nobody drew a clear trust boundary between system instructions and user-supplied content.
And the implications go far beyond GitHub. Every platform introducing AI agents that read untrusted content is now on notice. The GitLost vulnerability is a masterclass in why agentic systems need a fundamental rethink of how they distinguish trusted commands from untrusted data.
GitHub has been notified, and Noma has published a full technical breakdown of the exploit chain. But the handwriting on the wall is unmistakable: the age of trusting AI agents with unfettered access to your private codebase just ended — exactly the way security researchers warned it would.
Comments