# Critical Prompt Injection Vulnerability Exposes GitHub Agentic Workflows to Unauthenticated Data Theft


A severe security flaw in GitHub Agentic Workflows could allow attackers to steal sensitive data from private repositories without any credentials or technical sophistication. Researchers at Noma Labs discovered that the vulnerability—dubbed GitLost—leverages prompt injection attacks to trick AI-powered workflow agents into exposing private repository contents through public comments. An unauthenticated attacker needs only to craft a convincing GitHub Issue in any public repository to trigger the exploit.


## The Threat


GitHub Agentic Workflows, a relatively new automation feature that allows developers to write CI/CD logic in natural language, contains a critical vulnerability that undermines the very repositories it's designed to protect. By submitting a carefully crafted GitHub Issue to a public repository, unauthenticated attackers can manipulate the AI agent into accessing and leaking contents from private repositories that the organization maintains.


Key vulnerability characteristics:


  • Zero authentication required — attackers need no GitHub credentials or repository access
  • No technical skills needed — a simple GitHub Issue is sufficient to trigger the exploit
  • Private data exposure — agents with read access to private repositories become unwitting data thieves
  • Bypasses GitHub safeguards — built-in guardrails failed to prevent the attack
  • Wide attack surface — any organization using Agentic Workflows with default configurations is vulnerable

    • The vulnerability appears simple on the surface but exposes a fundamental architectural weakness in how AI agents handle untrusted input within development environments.


    ## Background and Context


    ### What Are GitHub Agentic Workflows?


    GitHub Agentic Workflows represent a paradigm shift in CI/CD automation. Instead of writing YAML-based GitHub Actions, developers can now describe their automation requirements in plain English within markdown files. GitHub's AI agent interprets these natural language instructions and executes them automatically—reading repository contents, analyzing code, posting comments, and triggering downstream actions.


    This approach dramatically lowers the barrier to entry for automation. Non-technical team members can theoretically set up complex workflows without understanding YAML syntax or GitHub Actions internals. The convenience, however, comes with a significant security cost.


    ### The Promise vs. The Reality


    The original value proposition is compelling: faster automation setup, more accessible DevOps, AI-powered code analysis embedded directly into development workflows. Organizations adopting Agentic Workflows expected GitHub's trust boundary to remain intact—that is, the agent would respect the distinction between public and private repositories.


    Instead, Noma Labs discovered that workflows often grant the agent read access across *both* public and private repositories simultaneously. The agent's context window becomes its attack surface. Any user-controlled content the agent reads—GitHub Issues, pull requests, comments, file contents—can be weaponized if the agent treats that content as instructional input.


    ## Technical Details


    ### How the Exploit Works


    The attack chain is straightforward:


    1. Attacker creates a crafted GitHub Issue in a public repository belonging to a target organization that uses Agentic Workflows

    2. The Issue contains a prompt injection payload—disguised as a legitimate request from company leadership or a well-known stakeholder

    3. The workflow agent reads the Issue—typically triggered by the issues.assigned event

    4. Hidden instructions direct the agent to fetch contents from private repository files and post them publicly

    5. Private data appears in public comments, visible to anyone


    Noma Labs demonstrated this by creating a plausible request that appeared to come from sales leadership, instructing the agent to retrieve README files from both public and private repositories and post them as comments. The attack succeeded without raising suspicion.


    ### GitHub's Failed Guardrails


    GitHub implemented prompt injection protections in Agentic Workflows to prevent exactly this type of attack. However, Noma Labs found that these guardrails could be circumvented through keyword variation. Specifically, when researchers added the word "additionally" to their prompt injection payload, the protections failed to block the instruction.


    This suggests that GitHub's safeguards rely on keyword filtering or pattern matching—a fragile defense mechanism against prompt injection attacks, which are inherently difficult to detect. Attackers can reformulate malicious instructions in countless ways, eventually finding bypass techniques.


    ### The Root Cause


    The fundamental issue reflects a broader challenge with agentic AI systems: the agent's context window is inseparable from its attack surface. Because the agent must read and interpret user-generated content (Issues, PRs, comments) to function, attackers can hide malicious instructions within that same content.


    Traditional web application security addresses analogous risks through input sanitization and parameterized queries (preventing SQL injection). AI agents, however, don't have a direct parallel. The content they read must be interpreted semantically—the agent's job is to understand instructions in natural language. Attempting to "sanitize" that input is equivalent to trying to prevent SQL injection by analyzing the semantic meaning of SQL itself.


    ## Implications


    ### Who Is Affected?


    Organizations face risk if they meet all these conditions:


  • Use GitHub Agentic Workflows
  • Grant workflows read access to private repositories
  • Configure workflows to trigger on public repository events (Issues, PRs, comments)
  • Have not implemented additional access controls or sandboxing

    • This likely encompasses most early adopters of Agentic Workflows, which were marketed as a low-friction way to automate development processes.


    ### Types of Data at Risk


    Attackers can exploit this vulnerability to exfiltrate:


  • Source code — proprietary algorithms, business logic, infrastructure details
  • Configuration files — API keys, authentication tokens, secrets (if poorly managed)
  • Documentation — internal architecture guides, roadmaps, design decisions
  • Credentials stored in repositories — SSH keys, private credentials committed to repos
  • Customer or business data — if stored in repository files or documentation

    • ### The Broader Risk: AI Supply Chain


    This vulnerability is not merely a GitHub-specific bug; it illustrates a fundamental risk in how modern AI systems are integrated into software development infrastructure. As organizations increasingly adopt AI agents to automate security scanning, code review, dependency analysis, and deployment processes, the potential for prompt injection attacks scales dramatically.


    An attacker who successfully exploits GitLost gains visibility into an organization's private code and infrastructure. This reconnaissance can inform subsequent attacks—targeted zero-day research, supply chain compromise, or credential theft.


    ## Recommendations


    ### Immediate Actions


    For organizations using GitHub Agentic Workflows:


    1. Audit workflow permissions — Review all Agentic Workflows to identify which have read access to private repositories. Restrict this access to only what is truly necessary.


    2. Disable workflows on public issues — If Agentic Workflows don't need to trigger on public repository events, disable those event triggers immediately.


    3. Implement approval gates — Require manual review or approval before agents take actions that could expose data (posting comments, reading private repositories).


    4. Separate public and private workflows — Create dedicated agents for public repository automation that have zero access to private repositories.


    5. Rotate any exposed secrets — If this vulnerability was active on your organization's workflows, assume any credentials stored in repositories may be compromised.


    ### Defense-in-Depth Strategy


    Noma Labs recommends treating prompt injection as agentic AI's equivalent to SQL injection in web applications—requiring systematic, layered defense:


  • Treat all user-controlled content as untrusted — Apply this principle to all inputs the agent reads
  • Restrict agent permissions to the minimum necessary — Use the principle of least privilege aggressively
  • Constrain what agents can post publicly — Prevent agents from posting content they retrieved from private sources
  • Implement input sanitization where feasible — While imperfect for semantic content, some filtering (length limits, keyword blocking) raises the bar for attackers
  • Monitor agent behavior — Log all data access and output; alert on anomalies like agents accessing private repositories during public Issue processing

    • ### Longer-Term Considerations


    The security community must develop better frameworks for agentic AI risk management:


  • Formal verification for prompts — Research techniques to prove agents won't execute unintended instructions
  • Sandboxing and isolation — Run agents in restricted environments with strict I/O boundaries
  • Adversarial testing — Before deploying agentic AI systems, conduct systematic prompt injection testing
  • Transparency in agent reasoning — Make it easier to understand *why* agents made decisions, improving auditability

    • ## HackWire Analysis


    The GitLost vulnerability reveals a critical blindspot in how organizations approach AI security: treating agentic AI systems as though they operate under the same trust boundaries as traditional software. They don't.


    GitHub Agentic Workflows exemplify a real inflection point in developer infrastructure. The convenience of natural language automation is genuine—but that convenience comes with a hidden cost. We're moving toward a world where the line between "instruction" and "data" dissolves. In traditional systems, this boundary is crisp: SQL queries vs. SQL data, shell commands vs. shell arguments. AI agents deliberately blur this line because understanding natural language requires semantic interpretation of content.


    This matters *right now* because GitHub Agentic Workflows are new enough that many early adopters configured them naively, following GitHub's documentation without thinking through threat modeling. Organizations that assumed "private repository" meant "protected" are learning that an AI agent with read access to private repos + write access to public comments = a data exfiltration vulnerability.


    The pattern recognition here is important: we're seeing the same vulnerability type—prompt injection—appear in widely different contexts over the past 18 months. Langflow-based ransomware campaigns, crypto payment attacks, and now data theft via GitHub Issues all exploit the same fundamental weakness: agents that interpret user-controlled content as instructions. Each time, attackers find novel bypass techniques for existing safeguards.


    The concrete next step for defenders is to audit *all* agentic AI deployments through a prompt injection lens. Ask: What user-controlled content can the agent read? What can it do with that information? Can it exfiltrate data, modify code, escalate privileges, or access other systems? If the answers are concerning, restrict the agent's access and oversight model immediately. Don't wait for the next researcher to demonstrate a bypass.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)