GitLost: GitHub AI Leaked Private Repositories

A new vulnerability, dubbed 'GitLost,' allowed GitHub's AI workflows to leak private repositories. Researchers at Noma Security Inc. discovered this critical prompt injection flaw. Here's the thing: an attacker could siphon data from private code repositories without authentication. They did this by simply posting a crafted issue in a public repository. This vulnerability targeted GitHub Agentic Workflows, which are AI-powered features designed to automate repository tasks. These workflows use an AI agent running on Anthropic's Claude or GitHub Copilot. What's interesting is that the attacker needed no coding skill or a GitHub account for the target. They buried hostile instructions in content the AI agent read, and the model followed them. For example, a workflow could be tricked into reading and posting the contents of README files from both public and private repositories as a public comment. GitHub had guardrails, but these could be bypassed by adding a specific word like "additionally" to the injected instructions. The bottom line: this highlights how AI agents, if not properly limited, can execute malicious instructions silently, without the owner knowing. This means your sensitive data could be at risk if you use these AI-powered automation tools.