Executive Summary
A public issue may manipulate GitHub Agentic Workflows into leaking private repository data when the agent has broad read access. Organizations using these workflows, particularly those granting agents access across repositories, should treat this as a high-priority agent security risk.
What Happened
A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization. If that organization has given the agent read access across its repositories, private ones
Affected Products
- GitHub Agentic Workflows
- GitHub
Vulnerability / Attack Technique
Indirect prompt injection through a public GitHub issue
Technical Mechanism
An attacker opens a normal-looking issue on a public repository. If the organization has granted the agent read access across its repositories, including private repositories, the issue can trick the workflow into leaking private repository contents.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
This demonstrates how untrusted external content can influence an AI agent with permissions beyond the content's originating repository. Teams operating AI agents should separate public-input processing from private-data access, minimize permissions, and verify that agent actions cannot transfer sensitive repository contents into attacker-controlled or publicly visible contexts.
Recommended Controls
- Apply least-privilege, repository-scoped permissions to GitHub Agentic Workflows.
- Treat public issues and other repository content as untrusted input and isolate them from private repository data.
- Require explicit human approval before an agent reads or exports sensitive repository contents.
- Add automated tests and red-team scenarios for indirect prompt injection and cross-repository data access.
- Monitor agent activity for unusual private-repository reads and disclosure of repository contents.
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.