Security researchers at Noma Security have identified a novel prompt injection exploit, named GitLost, that targets GitHub's Agentic Workflows feature. The exploit allows attackers to leak private repository data by embedding concealed instructions within public GitHub issues.
GitLost works by tricking GitHub's AI agent into executing malicious commands. When the agent processes a public issue containing hidden prompts, it can be manipulated to access and exfiltrate sensitive information from private repositories. This bypasses standard security safeguards designed to protect user data.
Noma Security disclosed the vulnerability to GitHub on July 10, 2026. GitHub acknowledged the issue and has since implemented mitigations to prevent the exploit. The company recommends users review their workflow configurations and avoid processing untrusted inputs.
The discovery highlights ongoing challenges with AI security, particularly in developer tools that integrate large language models. Prompt injection remains a critical vector for attacks, as AI agents often lack robust validation of user-supplied content.
As of July 24, 2026, no active exploits of GitLost have been reported in the wild. However, Noma Security advises developers to update their GitHub Actions and workflows to incorporate input sanitization and least-privilege principles.
