GitLost: A Public GitHub Issue Makes Agentic Workflows Leak Private Repos
GitLost: A Public GitHub Issue Makes Agentic Workflows Leak Private Repos is a high-severity prompt injection issue in GitHub Agentic Workflows, an AI agent. Affected: GitHub Agentic Workflows (feature released February 2026), Copilot and Claude backends.
Is GitHub Agentic Workflows running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
gitlost-a-public-github-issue-makes-agentic-workflows-leak-private-repos- Severity
- high
- Attack type
- Prompt injection, Information disclosure
- Component
- GitHub Agentic Workflows · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Noma Labs found that anyone able to open an issue on a public repository could make GitHub Agentic Workflows read private repositories in the same organization and post their contents as a public comment. No account compromise and no software exploit is involved: the agent reads the issue as instructions, fetches the requested files, and answers with the add-comment tool. Prefixing the malicious instruction with "Additionally" was enough to get past the guardrail, because the model treated it as a follow-on task rather than something to refuse.
Affected versions
| Affected | Fixed in |
|---|---|
GitHub Agentic Workflows (feature released February 2026), Copilot and Claude backends | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run GitHub Agentic Workflows (feature released February 2026), Copilot and Claude backends.
How do I fix it?
Never let user-submitted content reach an agent as instructions. Scope agentic-workflow tokens to the repositories the workflow needs rather than the whole org. Remove the ability to post publicly from any workflow that can read private code.
How do I find every machine running GitHub Agentic Workflows?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run GitHub Agentic Workflows and which version, then enforce a policy on it.