GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding concealed instructions within public GitHub issues, attackers can circumvent security safeguards and induce AI agents to reveal confidential information in public comments.

The vulnerable GitHub Agentic Workflow discovered by Noma Labs was configured to trigger on issues.assigned events, read the issue title and body, post a response comment using the add-comment tool, and operate with read access to other repositories, both public and private, within the organization.

To exploit this vulnerability, the attacker needed no coding skills, access, or credentials. All that was needed was to open an issue in a public repository belonging to an organization that uses GitHub’s Agentic Workflow setup and wait.

Noma reports that, despite GitHub having restrictive guardrails in place to prevent this scenario, the simple use of the keyword “Additionally” triggered unintended model behavior. This caused it to access the contents of an otherwise restricted file and publish them in a public comment.

Traditional security models typically assume that trust boundaries are enforced by code. In agentic systems, trust boundaries are partly enforced by the model’s behavior, and models are inherently instruction-following. Prompt injection attacks have become, to agentic AI, what SQL injections were to web applications: a systematic, category-wide vulnerability class that requires the same systematic strategies and defenses.

To mitigate these risks, Noma researchers recommend that user-controlled content should never be treated as trusted instruction input for an AI agent. Agent permissions should be restricted to what is strictly necessary, as agents with cross-repository access represent particularly valuable targets. Organizations should also limit what agents can publicly disclose, particularly when responding to issue content, and ensure that user input is properly sanitized or isolated from the instruction context before it is provided to the model.

Fractional CTO Vijendra Malhotra, commented on LinkedIn that Noma's finding demonstrates that:

the private repo was never a security boundary. It was an organisational one, and it held only as long as every reader of your code was a human you employed. Agents break that assumption. [...] If an agent has access to your private repos, treat everything in them as one well-crafted issue away from public.

On a similar note, Reddit user Significant_Sea_4230 observed that:

The dangerous part is not that the agent is "smart". It is that it may be connected to too much context, too many repos, or overly broad tokens.

User cH3332xr, on the other hand, highlighted that:

The "Additionally" bypass is the most interesting detail here — the payload itself didn't change, just the framing token that reclassified it from "new instruction" to "continuation of current task" in the guardrail's eyes. That's a decision-boundary problem, not a content problem

As a final comment from the community, mcv observed on Hacker News:

SQL injection was caused by treating user input as part of the instruction instead of as the pure data that it was intended as. Separating those two fixed it. Prompt injection is unavoidable because the user input is intended as instruction.

For a deep dive into the technical details and proof-of-concept, read the full report on Noma's website.