AI Agent Flaw Lets Anyone Leak Private GitHub Data via Hidden Instructions

Noma Security researchers have uncovered a significant security vulnerability in GitHub's Agentic Workflows that enables attackers to extract private repository data without requiring any credentials or coding expertise. The exploit, called GitLost, demonstrates how concealed instructions embedded in public issue comments can bypass AI safeguards and trick automated agents into revealing sensitive information.

How the Attack Works#

The vulnerability targets GitHub workflows configured to automatically respond to new issues. An attacker simply needs to open an issue in any public repository belonging to an organization running these AI agents, then embed hidden instructions within the issue content. The workflow's AI agent processes the request, unaware that it has been manipulated into accessing and disclosing restricted files in public comments.

Remarkably, the researchers found that inserting a single word — "Additionally" — was enough to circumvent GitHub's built-in guardrails. This framing keyword caused the model to misclassify a new instruction as a continuation of its current task, enabling it to access otherwise restricted content.

Why Traditional Defenses Fail#

The underlying challenge differs fundamentally from past vulnerabilities like SQL injection. Traditional security architectures rely on code-level trust boundaries, but AI agents operate differently: they interpret natural language instructions inherently, making user input indistinguishable from legitimate commands.

The core problem: unlike databases, which can separate data from instructions through structured queries, AI models treat both as language. A workflow agent with permission to read multiple repositories cannot easily distinguish between legitimate requests and malicious ones hidden in issue descriptions.

Mitigation Strategies#

Noma recommends a multi-layered defense approach:

• Principle of least privilege: Restrict agent permissions strictly to what is necessary; cross-repository access dramatically increases exploitation risk
• Input isolation: Never treat user-controlled content as trusted instruction input — sanitize or segregate it from the agent's core directives
• Output controls: Limit what agents can publicly disclose, especially when responding to user-submitted content