GitLost lets unauthenticated attackers siphon private repo data via public GitHub issues
Researchers at Noma Labs uncovered GitLost, a prompt‑injection flaw in GitHub’s new Agentic Workflows. By posting a crafted issue in any public repo of an organization, an attacker can trigger the AI agent to read and exfiltrate contents of private repositories without credentials. The bug highlights the danger of giving AI agents unchecked access to internal code.