Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization. If that organization has given the agent read access across its repositories, private ones

According to Noma Security, the "GitLost" vulnerability in GitHub Agentic Workflows allows an unauthenticated attacker to post a crafted but normal-looking issue in a public repository that, via hidden natural-language instructions, causes the AI agent to read from and leak data in the organization’s private repositories when the agent has cross-repository read access.[1][3] This is a textbook *indirect prompt injection* / Agentic Workflow Injection case, where user-controlled issue text is ingested into the agent’s prompt and converted into data-exfiltrating behavior without any stolen credentials or direct code exploit.[3][4] From a RealGround perspective, this highlights the need to redesign agent workflows so untrusted GitHub events (issues, PR descriptions, comments) are never treated as trusted instructions, to enforce strict least-privilege on cross-repo access, and to continuously red-team agent behavior against prompt-injection and data leakage scenarios. Organizations should use Secure AI Agent Build and AI Agent Business Logic Audit to harden workflow design, and Continuous AI Red Teaming to repeatedly test for similar AWI flaws before they reach production.