No permissions needed, no login required, not even a single line of code — you just open a normal-looking Issue in a public repository, and GitHub's AI Agent automatically reads the contents of private repos in the same organization and posts them in a public comment for everyone to see.

This isn't science fiction; it's the GitLost vulnerability disclosed by security firm Noma Labs on July 6. In 2026, as AI coding tools go fully agentic, this vulnerability is a wake-up call for every team using AI Agents to manage code repositories.

The Attack Flow Is Shockingly Simple

GitLost exploits classic indirect prompt injection, but the implementation is so simple it sends chills down your spine.

The vulnerability's prerequisite is that the target organization has enabled GitHub Agentic Workflows — GitHub's major feature launch this year that combines GitHub Actions with an AI Agent (powered by Claude or Copilot), letting teams write workflows in natural-language Markdown while the AI agent automatically reads Issues, calls tools, and executes operations. The problem: when this workflow is configured to trigger on Issue assignment, and the Agent has read access to other repos in the organization (including private ones), disaster strikes.

An attacker only needs three steps: First, create an Issue in a public repo of the target organization, disguised as a normal business request — like "VP Sales asked to compile the following docs after a customer meeting." Second, hide injection instructions in plain English in the Issue body, telling the AI Agent to go read README.md or other files from private repos. Third, wait for GitHub automation to assign the Issue. Once the assignment event triggers, the Agent reads the Issue, gets duped by the hidden instructions, and obediently posts private repo contents as a comment on the public Issue.

No permissions required, no need to be an org member, no password cracking — just the ability to open an Issue. Noma Labs fully reproduced the vulnerability in their test repos; the PoC is publicly verifiable, and leaked content includes the full README.md from their test private repo.

One Word — "Additionally" — Bypasses All Guardrails

What's even more absurd is that GitHub actually had guardrails in place — defeated by a single keyword.

Noma Labs researchers found that GitHub's Agent does have content safety protections — when you directly ask it to output private repo content, it refuses. But simply adding the word "Additionally" in front of injection instructions causes the model to reframe its output logic, bypassing the refusal mechanism and posting the content directly. Researchers tested multiple variants and found this trigger word reliably effective.

This detail exposes a fundamental problem in AI Agent security: the Agent's context window is also its attack surface. Any content the Agent reads — Issues, PRs, comments, files — can be weaponized if the Agent treats it as trusted instructional input. Traditional security models assume trust boundaries are enforced by code; in Agent systems, trust boundaries are partly enforced by model behavior, and models are fundamentally "instruction-following machines."

GitLost isn't the first AI Agent security vulnerability, and it won't be the last. As more and more teams hand code repos, deployment pipelines, and even cloud resource permissions to AI Agents, the prompt injection attack surface is expanding exponentially. Noma Labs' recommendations are pragmatic: never treat user-controlled content as trusted instruction input for an AI Agent; minimize permissions, especially cross-repo access; restrict what agents can post publicly; sanitize or isolate user input before passing it to the model.

AI coding is indeed boosting development efficiency exponentially — but every step forward in efficiency requires two steps forward in security guardrails. Otherwise, your core code, written over months, could be completely exposed by a single "Additionally."

See you tomorrow.