Return to Threats

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

securityweek.com 2026-07-08 indirect prompt injection Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A crafted public GitHub Issue can manipulate AI-powered workflows into exposing private repository data without authentication. Teams using agentic software-development workflows should treat this as a high-priority prompt-injection and data-leakage risk.

What Happened

Researchers show how attackers can use a crafted public GitHub Issue to trick AI-powered workflows into exposing data from private repositories without authentication. The post Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection appeared first on SecurityWeek .

Affected Products

  • GitHub Agentic Workflows

Vulnerability / Attack Technique

Prompt injection via crafted public GitHub Issue

Technical Mechanism

Attackers use a crafted public GitHub Issue to provide instructions that trick AI-powered workflows. The manipulated workflows can then expose data from private repositories without authentication.

AI Security Category

LLM01:2025 Prompt Injection

Part of the Prompt Injection topic.

Relevant Frameworks

LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive AgencyMITRE ATLAS: Initial AccessMITRE ATLAS: Exfiltration

RealGround Analysis

Agentic workflows that process publicly submitted content can create a trust-boundary failure when untrusted instructions influence privileged actions or data access. Teams should validate inputs, constrain agent permissions, and test whether public artifacts can cause private-data retrieval or disclosure.

Recommended Controls

  • Treat GitHub Issues and other public repository content as untrusted input and isolate it from privileged workflow instructions.
  • Apply least-privilege permissions and repository-level access controls to AI-powered workflows.
  • Require human approval or deterministic policy checks before agents access or disclose private repository data.
  • Conduct adversarial red-team testing for prompt injection through public issues, pull requests, commits, and documentation.
  • Log and alert on agent-initiated access to private repositories and attempted sensitive-data exfiltration.

Related RealGround Service

AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.

Sources

securityweek.com: https://www.securityweek.com/critical-vulnerability-exposes-github-agentic-workflows-to-prompt-injection/

Summary and analysis written by RealGround from the source above; last updated 2026-10-18.

Talk to AI CISO