TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by pos...

Per usual, there's no fix - or even any documentation - for GitLost

Per usual, there's no fix - or even any documentation - for GitLost

GitHubの公開リポジトリに投稿されたIssueへ悪意ある指示を紛れ込ませることで、AIエージェントに非公開リポジトリの内容を公開コメントとして投稿させるプロンプトインジェクションの脆弱(ぜいじゃく)性「GitLost」をセキュリティ企業のNoma Labsが報告しました。攻撃者は認証情報やリポジトリへのアクセス権を持っていなくても、組織の公開リポジトリにIssueを作成するだけで攻撃を成立させられる可能性があったとされています。

Per usual, there's no fix - or even any documentation - for GitLost

Security Now details how these innovative attack techniques are exploiting AI agents and why developers and users must take action.

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators

A newly disclosed vulnerability dubbed "GitLost" shows how attackers can weaponize a single GitHub Issue to trick GitHub's new AI-powered Agentic Workflows into leaking private repository contents to ...

TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by pos...

A look at GitLost, the GitHub Agentic Workflows prompt-injection case where public issue text, private repo access, and public comments collide.

Noma Labs details GitLost, a prompt injection flaw that made GitHub's AI agent expose private repo data through a crafted public issue and guardrail failures.

TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by pos...

GitLost showed that GitHub Agentic Workflows could be steered from a public GitHub issue into reading a private repository and posting its contents publicly. The affected feature is GitHub Agentic Workflows, a Copilot feature in public preview, and the disclosed proof of concept depended on the same agent having access to untrusted public issue text and readable private repositories in one organization.

Noma Security demonstrated a technique where a malicious public GitHub issue could manipulate an organization’s Agentic Workflow—granted read access to private repositories—to exfiltrate private repo contents via a public comment. The attack required no stolen credentials or write access, relying instead on indirect prompt injection to exploit the workflow’s permissions. GitHub’s threat-detection guardrail was bypassed by prefixing the malicious instruction with the word 'Additionally,' allowing the payload to evade output scanning. Similar vulnerabilities have been reported in other AI-driven GitHub integrations, where public issues triggered unauthorized data leaks.

Per usual, there's no fix – or even any documentation – for GitLost

Per usual, there's no fix – or even any documentation – for GitLost

Per usual, there's no fix - or even any documentation - for GitLost

Una investigación de Noma Labs ha mostrado cómo un atacante podía utilizar una incidencia pública de GitHub para inducir a […]