{
  "entry": {
    "kind": "vuln",
    "slug": "gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos",
    "name": "gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos",
    "vendor": "GitHub Agentic Workflows",
    "description": "Noma Labs found that anyone able to open an issue on a public repository could make GitHub Agentic Workflows read private repositories in the same organization and post their contents as a public comment. No account compromise and no software exploit is involved: the agent reads the issue as instructions, fetches the requested files, and answers with the add-comment tool. Prefixing the malicious instruction with \"Additionally\" was enough to get past the guardrail, because the model treated it as a follow-on task rather than something to refuse.",
    "website": "https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-06",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos",
      "aliases": [
        "ti-056"
      ],
      "title": "GitLost: A Public GitHub Issue Makes Agentic Workflows Leak Private Repos",
      "summary": "Noma Labs found that anyone able to open an issue on a public repository could make GitHub Agentic Workflows read private repositories in the same organization and post their contents as a public comment. No account compromise and no software exploit is involved: the agent reads the issue as instructions, fetches the requested files, and answers with the add-comment tool. Prefixing the malicious instruction with \"Additionally\" was enough to get past the guardrail, because the model treated it as a follow-on task rather than something to refuse.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Information disclosure"
      ],
      "componentType": "agent",
      "component": {
        "name": "GitHub Agentic Workflows",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "GitHub Agentic Workflows (feature released February 2026), Copilot and Claude backends",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-06",
      "modifiedAt": "2026-07-06",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/"
        }
      ],
      "mitigation": "Never let user-submitted content reach an agent as instructions. Scope agentic-workflow tokens to the repositories the workflow needs rather than the whole org. Remove the ability to post publicly from any workflow that can read private code.",
      "detectedByAnomity": true
    }
  }
}