Key Takeaways
- GitLost is an indirect prompt‑injection attack that lets an attacker trick GitHub’s Agentic Workflows into leaking private repository data without needing credentials or exploiting a software bug.
- The attack succeeds because AI agents interpret hidden instructions in seemingly innocuous content (e.g., a public GitHub issue) as legitimate continuation of a task.
- GitHub’s existing defenses (read‑only defaults, sandboxing, firewall isolation, output validation, threat‑detection scanning, integrity filters) can be bypassed by subtle linguistic tweaks such as inserting the word “Additionally.”
- GitLost satisfies the “Lethal Trifecta”: the AI has access to sensitive data, processes untrusted external input, and can exfiltrate information via public comments.
- Enterprise risk scales with the permissions granted to AI agents—organization‑wide read access, automatic commenting, and lack of human review dramatically increase exposure.
- Mitigation must focus on architectural controls (least‑privilege token scoping, disabling auto‑publish of sensitive outputs, requiring human approval, restricting who can trigger workflows) rather than relying solely on prompt‑injection detection or output filtering.
- The incident marks a shift in AI security from patching software bugs to managing trust boundaries and delegated permissions in autonomous agent ecosystems.
Introduction to the GitLost Technique
The rapid adoption of AI‑powered software development tools has introduced a new class of cybersecurity risks. Security researchers at Noma Security disclosed a technique called GitLost, an indirect prompt‑injection attack that convinces GitHub’s newly released Agentic Workflows to retrieve and expose confidential information from private repositories. Notably, the attack requires no compromised credentials, malware, privilege escalation, or direct intrusion; it merely manipulates the AI’s interpretation of instructions embedded in untrusted content.
How Agentic Workflows Function
GitHub introduced Agentic Workflows earlier this year as an AI‑driven extension of GitHub Actions, allowing developers to automate complex engineering tasks using natural language instead of traditional YAML files. Developers describe desired behavior in Markdown; GitHub then converts those instructions into executable workflows that can invoke large language models such as GitHub Copilot, Anthropic Claude, Google Gemini, or OpenAI Codex. These agents perform tasks like issue triage, pull‑request reviews, documentation updates, CI/CD failure investigations, security analysis, dependency maintenance, and cross‑repository code discovery. Unlike deterministic GitHub Actions, Agentic Workflows rely on LLMs capable of reasoning about repository content and dynamically deciding which actions to take, introducing a fundamentally different security model.
GitLost Exploits Trust, Not Software Bugs
Traditional vulnerabilities stem from memory corruption, authentication failures, or programming errors. GitLost, however, belongs to the category of indirect prompt injection, where malicious instructions are hidden inside content that an AI agent is expected to process. In the proof‑of‑concept, the attacker opened what appeared to be a legitimate issue on a public GitHub repository. The issue was crafted to resemble an ordinary business request following a customer meeting. Embedded within the seemingly innocent text were additional instructions directing the AI agent to retrieve data from a private repository and include that information in its public response. When the issue was automatically assigned, the organization’s Agentic Workflow processed it as designed, obeying the embedded instruction because it possessed read access across multiple repositories, including private ones. The AI agent complied, retrieved a private README file, and published its contents in a publicly visible GitHub comment. No authentication bypass or GitHub vulnerability was exploited; the AI simply obeyed instructions it incorrectly interpreted as legitimate.
Subtle Language Tweaks Defeat Built‑In Protections
GitHub anticipated prompt‑injection attacks and incorporated several defensive mechanisms into Agentic Workflows: read‑only permissions by default, sandboxed execution environments, Agent Workflow Firewall isolation, safe output validation, threat‑detection scanning before responses are published, and integrity filters designed to reduce prompt‑injection risks. Despite these layers, Noma researchers found that these safeguards could be bypassed with a remarkably simple change—adding the word “Additionally” before the malicious instruction. This subtle alteration caused the language model to treat the injected text as a natural continuation of the original task, allowing it to survive GitHub’s output validation before confidential information was published. The finding underscores a core challenge in AI security: minor, innocuous‑looking changes in natural language can dramatically alter model behavior while evading automated detection systems.
Why GitLost Represents a Different Class of AI Attack
According to Noma Security researcher Sasi Levi, GitLost differs from earlier prompt‑injection demonstrations that primarily manipulated what AI systems said. GitLost instead manipulates what AI systems do. Modern AI agents increasingly operate with credentials that grant them access to source code, repositories, documentation systems, cloud environments, and internal development infrastructure. Rather than serving merely as conversational assistants, these agents act as credentialed actors capable of interacting with sensitive enterprise resources. If an attacker can influence the agent’s reasoning process, they may indirectly gain access to data protected by the agent’s permissions rather than their own. In essence, GitLost weaponizes delegated trust—the authority granted to the AI agent becomes the attack vector.
The Lethal Trifecta Framework
The research reinforces Simon Willison’s concept of the “Lethal Trifecta.” AI systems become particularly dangerous when three conditions coexist: (1) the AI has access to sensitive information, (2) it processes untrusted external content, and (3) it possesses a mechanism for sending information elsewhere. GitLost satisfies all three: the Agentic Workflow can read confidential repositories, it processes publicly submitted GitHub issues, and it can publish comments visible to anyone. When these capabilities align, prompt injection transforms from a mere annoyance into a potent exfiltration mechanism. Researchers argue this reflects an architectural limitation of autonomous AI systems rather than a conventional software vulnerability that can be patched.
GitLost Is Part of a Broader Trend
GitLost is far from isolated. Over the past year, multiple security teams have demonstrated similar attacks against AI‑powered development environments. Malicious GitHub issues have been shown to coax coding assistants into revealing API keys, repository tokens, and confidential source code through carefully crafted prompts. Earlier work from Invariant Labs demonstrated prompt injection against GitHub‑connected AI agents operating via Model Context Protocol (MCP) servers, concluding that the problem stems from architectural assumptions rather than implementation flaws. Orca Security similarly showed how hidden prompts inside GitHub issues could convince AI assistants to expose privileged authentication tokens. Academic researchers have published numerous studies on Agentic Workflow Injection (AWI) vulnerabilities, identifying hundreds of potentially exploitable GitHub workflows. Additional research into “Comment and Control” attacks revealed that AI coding agents from multiple vendors—including GitHub Copilot, Claude Code, and Gemini CLI—could be influenced into leaking sensitive credentials under realistic conditions. Collectively, these findings indicate that prompt injection is evolving into a defining security challenge of the emerging agentic AI ecosystem.
GitHub’s Security Architecture Assumes Agent Failure
GitHub has publicly documented that Agentic Workflows were built under a “security‑first” philosophy. Rather than trusting AI models, GitHub isolates them within sandboxed environments, restricts default permissions, validates outputs, and places agent execution behind multiple defensive layers intended to mitigate the consequences of compromised behavior. The company’s security architecture explicitly assumes that AI agents may eventually attempt unauthorized actions or become influenced by malicious content. Instead of trying to prevent every possible attack, GitHub aims to constrain what an agent can accomplish through layered isolation and least‑privilege access controls. GitLost demonstrates that while these architectural safeguards significantly reduce risk, they cannot fully eliminate attacks that exploit the inherent ambiguity of natural language.
Enterprise Exposure Depends on Permission Scope
Not every GitHub organization is equally vulnerable to GitLost. Successful exploitation hinges on how organizations configure their AI workflows. The highest‑risk deployments share four traits: (1) AI agents are allowed to process public GitHub issues, (2) agents are granted organization‑wide read permissions, (3) workflows are permitted to publish comments automatically, and (4) there is no human review before responses are posted. Organizations that follow GitHub’s default least‑privilege model—limiting agents to specific repositories and requiring manual approval—are considerably less exposed. However, many enterprises broaden agent permissions for convenience, enabling AI assistants to search across multiple repositories when investigating issues or generating documentation. This expanded visibility dramatically increases the potential impact if an AI agent becomes manipulated. Depending on repository permissions, exposed information could include proprietary source code, internal documentation, architectural diagrams, configuration files, CI/CD metadata, and, in some cases, sensitive development secrets.
Mitigation Requires Architectural Controls, Not Just Filters
Noma Security argues that relying solely on prompt‑injection detection or output filtering is insufficient. Instead, organizations should minimize the authority delegated to AI agents from the outset. Key recommendations include:
- Limit personal access tokens to individual repositories rather than granting organization‑wide access.
- Prevent public‑facing workflows from automatically publishing sensitive outputs.
- Restrict which users can trigger AI workflows, reducing the attack surface.
- Require human approval before externally visible responses are posted.
- Apply strict least‑privilege principles to every AI integration, ensuring agents only have the permissions they truly need.
- Treat AI agents as potentially compromised components rather than trusted automation, incorporating monitoring and anomaly detection.
These measures shrink the blast radius of a successful prompt‑injection attack, even if malicious instructions bypass the model’s internal safeguards.
AI Security Is Shifting from Software Bugs to Trust Boundaries
GitLost illustrates a broader transformation in enterprise cybersecurity. Traditional application security focuses on software vulnerabilities that developers can eventually patch. AI security, however, increasingly revolves around trust relationships, delegated permissions, and architectural boundaries. Because large language models fundamentally process natural language rather than rigid programming syntax, separating data from executable instruction is far more difficult than in conventional computing systems. Consequently, many future AI security issues may never receive definitive patches; organizations will likely need to redesign how autonomous agents receive permissions, access sensitive resources, and interact with untrusted content. As AI becomes further embedded throughout CI/CD pipelines, software supply chains, and enterprise development environments, GitLost serves as a stark reminder that autonomy without carefully constrained trust can quickly become a security liability. For enterprises embracing agentic software development, the lesson is clear: the greatest risk may not be what AI systems know—but what they are authorized to do when someone else controls the conversation.
