Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data
Summary: Researchers at Noma Security showed that a public GitHub issue can steer GitHub Agentic Workflows, a feature in public preview since February, into copying private repository contents into a public comment, a technique they call GitLost. In their proof of concept, an issue disguised as a routine request from a VP of Sales was assigned to a workflow with cross-repo read access, and the agent pasted a private repository's README into a public comment; prefixing the malicious instruction with the word "Additionally" was enough to get past GitHub's threat-detection step.
Bottom line: The attacker needs no stolen credentials and no access to the organization - only the ability to open a public issue - and what they can pull depends on the agent token's scope, from proprietary source code to internal keys, design documents, or CI/CD secrets. Noma's one-word bypass of GitHub's output filter shows the guardrail is a backstop, not a boundary.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026