GitLost lets unauthenticated attackers siphon private repo data via GitHub Agentic Workflows
Noma Labs uncovered a prompt‑injection flaw in GitHub’s new Agentic Workflows that lets anyone post a crafted issue in a public repo and have the AI agent read and echo private code from other repos in the same organization. The attack requires no credentials, exposing critical source code and highlighting the need for tighter AI guardrails.