GitLost: Prompt Injection Vulnerability in GitHub AI Agents

GitHub AI Agents Vulnerable to Private Repository Leakage

Researchers from Noma Security have demonstrated a vulnerability dubbed "GitLost," where GitHub's AI agents can be manipulated into leaking contents of private repositories. This occurs when an agent is configured with read access to an organization's private repositories but is triggered by untrusted public input, such as a GitHub issue. By using prompt injection, an attacker can trick the agent into ignoring its system instructions and instead retrieving and disclosing sensitive code from private repositories.

The Attack Vector: Prompt Injection

GitLost leverages prompt injection, a technique where an attacker provides input that the AI model interprets as a system-level command rather than data. In the case of the GitHub agentic workflow, the attack works as follows:

Trigger: The agent is triggered by an event, such as an issues.assigned event.
Input: The attacker creates a public issue with a body containing malicious instructions (e.g., using words like "Additionally" to pivot the agent's focus).
Execution: The agent reads the issue body, treats the injected instructions as trusted directives, and uses its available tools (such as repository reading tools) to access private repositories within the organization.
Exfiltration: The agent posts the leaked private code as a comment on the public issue.

Critical Configuration Failures

The vulnerability is not a flaw in the LLM's reasoning, but a failure in the trust boundary and permission architecture. The specific vulnerable workflow discovered by Noma Labs was configured to:

Trigger on issues.assigned events.
Read the issue Title and Body.
Post comments using the add-comment tool.
Run with read access to other repositories (both public and private) in the organization.

By granting the agent broad organization-level permissions while allowing it to process untrusted public data, the system creates a path for private data to be exfiltrated to a public forum.

Technical Debate: Architecture vs. Prompting

The GitLost discovery has sparked a significant debate among security professionals regarding the nature of AI vulnerabilities.

Prompt Injection as the "New SQL Injection"

Some argue that prompt injection is a category-wide vulnerability class similar to SQL injection. In the early days of the web, SQL injections occurred because user input was treated as part of the command string. The fix was prepared statements that separated data from logic. Similarly, critics argue that the only way to solve prompt injection is through architectural changes—such as strict menus of fixed behaviors—rather than attempting to "patch" the LLM's prompts.

The Role of Least Privilege

Many technical observers point out that the core issue is a violation of the principle of least privilege. If an agent does not need access to private repositories to resolve a public issue, it should not have those permissions.

"If you don’t want an AI Agent to read private repos then you do not give the AI agent access to the private repos. This is not a permission bypass issue but a prompt injection issue which can’t be reliably solved at the Agent layer"

Summary of Mitigation Strategies

To prevent similar leaks, organizations should implement the following security measures:

Strict Permission Scoping: Agents should only have access to the specific repositories required for the task at hand, rather than organization-wide read access.
Identity-Based Access Control: Agents should be assigned specific credentials and subject to the same authentication and authorization (authz) checks as human users.
Sandboxing: LLMs with access to tools should be executed in isolated environments to prevent lateral movement or unauthorized data access.
Avoid Trusting Public Input: Treat all data retrieved from public issues or PRs as untrusted and should never be used to drive high-privilege tool execution.