GitLost: Noma Labs Discovers GitHub AI Agent Prompt Injection Vulnerability

Noma Labs revealed a prompt injection flaw named GitLost that allows attackers to force GitHub AI agents into leaking private repository contents.

The flaw requires no authentication or coding skills. An attacker simply opens a public issue inside an organization that also hosts private repositories.

The AI agent then follows the hidden instructions and returns data from those private repositories.

This outcome directly challenges assumptions that GitHub agent workflows keep user content separated from trusted instructions.

Attack Starts With One Public Issue

An attacker creates an issue in a public repository that belongs to the target organization. The issue contains a crafted prompt that begins with benign text and hides a command after the word "Additionally".

The GitHub AI agent reads the issue as part of its workflow context and treats the hidden command as legitimate instruction. It then accesses other repositories within the same organization and returns their file lists or contents.

Noma Labs published a proof of concept that reproduces the full chain. The attack succeeds against both Claude-based and Copilot-based agents when they operate inside GitHub agentic workflows.

Why Current Controls Failed

GitHub added safety filters that look for direct instruction overrides. The filters stop at specific patterns and do not scan text that follows the word "Additionally".

Because the malicious payload sits after that token, the agent still executes the command. The same filter gap exists in both Claude and Copilot integration paths.

The root issue remains simple. The agent receives user-controlled text inside the same context window as system instructions and has no reliable way to distinguish the two.

Stakes For Organizations Using GitHub Agents

Any company that enables agentic workflows on GitHub now faces a concrete exposure path. Private code, internal documentation, and configuration files become reachable through a single public issue.

Security teams must decide whether to disable cross-repository access for agents or accept the risk until GitHub ships stronger input isolation.

Developers who already rely on these agents lose the previous assumption that public issues stay isolated from private data.

Limits of Isolation Fixes

Restricting agents to read-only access on public repositories reduces the blast radius. However, many organizations need agents to inspect private code for review or documentation tasks.

Complete isolation would remove the main reason teams adopted the feature. Partial fixes still leave the core prompt trust problem unsolved.

Noma Labs recommends treating every user-generated field as untrusted and routing agent actions through an explicit permission boundary.

Remaining Uncertainties

GitHub has not yet published a timeline for updated filters. It remains unclear whether the company will change how agents parse context or simply add more pattern checks.

Independent researchers have not verified whether the same bypass works outside organization boundaries or against other hosted agent platforms. Those tests are still pending.

What To Watch Next

Watch for GitHub to release an updated agent runtime that enforces strict separation between user text and system prompts. A public changelog entry would show the fix is live.

Watch for Noma Labs or other groups to test the same technique against additional agent providers. Any confirmed extension would widen the affected surface.

Watch for enterprise adoption numbers of GitHub agent workflows after the disclosure. A measurable drop would indicate customers are pausing rollout until stronger controls appear.