GitLost Flaw: GitHub AI Agent Leaks Private Repos

A new security flaw, dubbed "GitLost," allows attackers to trick GitHub's AI agent into leaking private information. This vulnerability affects GitHub's months-old Agentic Workflows. Here's the thing: an attacker can use indirect prompt injection to make the AI agent grab data from a private repository. Then, the agent quietly posts this information in a public repository belonging to the same organization. What's interesting is that this differs from classic prompt injection, which usually manipulates what an AI says. GitLost manipulates what the AI agent *does* with its permissions. The AI agent acts as a credentialed actor with read access to repositories the attacker doesn't have access to. The exploit doesn't require coding skills, stolen credentials, or even write access to private areas. An attacker only needs to open a public issue, which often requires no special privileges. This makes it a much lower bar for attackers. The bottom line: this flaw highlights the growing risks of AI agents and their vulnerability to deceptive tactics.