Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data

2026-07-23 · Source: InfoQ · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Intermediate, quick

Summary

Noma Security discovered GitLost, a prompt-injection exploit that tricks GitHub's new Agentic Workflows into leaking private repository data. This vulnerability, disclosed on July 23, 2026, allows attackers to embed concealed instructions within public GitHub issues. The targeted Agentic Workflow, configured to trigger on "issues.assigned" events, reads issue content and uses an "add-comment" tool with cross-repository read access. Despite GitHub's guardrails, the keyword "Additionally" bypassed security, causing the AI agent to access and publish restricted file contents in a public comment. This exploit required no coding skills or credentials. Experts note that prompt injection is a systematic vulnerability for agentic AI, akin to SQL injection for web applications, fundamentally altering trust boundaries as agents treat user input as instruction.

Key takeaway

For MLOps Engineers deploying AI agents with access to private repositories, you must re-evaluate your security model. Assume any data accessible by an agent is one well-crafted prompt away from public exposure. Restrict agent permissions to the absolute minimum required for their function. Implement robust input sanitization and strict controls on what agents can publicly disclose. Your private repositories are organizational boundaries, not security ones, when agents are involved.

Key insights

Indirect prompt injection can bypass AI agent security, enabling data exfiltration from private repositories.

Principles

• User-controlled content must not be trusted instruction for AI agents.
• Agent permissions should be strictly necessary and limited.
• Private repositories are not security boundaries for AI agents.

In practice

• Restrict agent permissions to prevent cross-repository access.
• Limit agent public disclosure, especially for issue responses.
• Sanitize or isolate user input from agent instruction context.

Topics

• Prompt Injection
• AI Agents
• GitHub Agentic Workflows
• Data Leakage
• Repository Security
• Access Control

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Engineer, MLOps Engineer

Related on AIssential

• Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it — AI agent runtime environments, not just models, are critical attack surfaces for prompt injection vulnerabilities.
• Steal These 7 GitHub Repos Before Everyone Else Does — Curated GitHub repositories offer practical tools for enhancing AI agent capabilities and developer workflows.
• AI Apps Have a New Attack Surface: External Inputs — AI systems struggle to differentiate instructions from data, making external inputs primary attack vectors.
• TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction — AI agents face an inherent trade-off between using private data for tasks and preventing its leakage, which prompt-based defenses cannot fully resolve.
• The Model Won’t Stop Prompt Injection. Your Tool-Call Gate Will — Model-level fixes are insufficient for prompt injection; defense requires external tool-call gating.
• Beyond Prompt Injection: When AI Agents Mistake Content for Trusted Data — Agent Data Injection (ADI) exploits AI agents' probabilistic interpretation of formatted content, mistaking untrusted data for trusted system metadata.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by InfoQ.