AI Security Briefing

What it is

"GitLost," a Noma Security proof-of-concept indirect prompt injection against GitHub Agentic Workflows (public preview since February, powered by Copilot, Claude, Gemini, or Codex). A public issue makes an org-scoped agent paste a private repo's README into a public comment — no credentials, no write access needed.

How it works

The workflow triggers on issue-assignment, reads the issue, and replies with a comment. Noma disguised the malicious issue as a routine request from a "VP of Sales." Because the agent's token has cross-repo read access, the injected instruction steers it to fetch a private repository's README and post it publicly. The distinguishing point Noma's Sasi Levi stresses: earlier injection was about what an agent said; GitLost is about what a credentialed actor does with its permissions inside CI/CD-adjacent infrastructure.

Preconditions / Affected

All three must hold (the "lethal trifecta"): the org enabled the preview, wired the agent to read untrusted public input, gave it a token with read access to private repos, and the workflow can post publicly. The cross-repo access comes specifically from a personal access token the organization sets up — that PAT's scope is the whole exposure.

What to do

The page's mitigations, in order of leverage:

• Scope the PAT to the single repository the workflow triages, not org-wide read. Levi: a single-repo token is "far less dangerous than one issued broad org-wide read access." This is the control that matters most.
• Limit what a public-facing workflow can post — writes flow only through declared safe outputs, and the comment it produces is the exfiltration channel.
• Restrict which authors' content the agent will act on.
• Gate outputs behind human review.

Do not rely on GitHub's threat-detection step alone: Noma bypassed it by prefixing the malicious instruction with "Additionally," so the model treated it as a follow-on task. Treat the filter as a backstop, not a boundary.

Caveats

This is not patchable. Levi frames it as a structural consequence of giving agents standing credentials while they read attacker-reachable text — echoing Invariant Labs' May 2025 MCP finding, which its researchers also called architectural with no server-side fix. What an attacker extracts depends entirely on token scope: source code, internal keys, design docs, or CI/CD secrets. Noma disclosed to GitHub and published with the company's knowledge.

flowchart TD
    A[Attacker opens public issue] --> B{Agent has org-wide<br/>read PAT?}
    B -->|No, single-repo token| X[Blast radius limited]
    B -->|Yes| C[Agent reads injected<br/>instruction]
    C --> D{Threat-detection<br/>scan}
    D -->|'Additionally' prefix| E[Private README posted<br/>in public comment]
    D -.blocked.-> X