# GitHub AI Agent Leaks Private Repositories > Source: > Published: 2026-07-07 19:49:01+00:00 # GitHub AI Agent Leaks Private Repositories Noma Labs disclosed **GitLost**, a **July 2026** prompt-injection technique that could make GitHub Agentic Workflows leak private repository contents through a public issue comment. Noma says an unauthenticated attacker only needed to create a plausible issue in a public repository when the workflow's agent had broader repository read access. The Hacker News and The Register describe the issue as an architectural agent-risk pattern rather than a simple patchable bug: untrusted text, private-data access and a public output channel are enough to create an exfiltration path. For teams using GitHub Copilot, Claude or other agents in development workflows, the practical control is tight token scoping, output review and treating issues as hostile input. The practitioner lesson from GitLost is that AI development agents inherit the blast radius of the credentials and output channels around them. A public GitHub Issue is ordinary user content, but if an agent reads it while holding broad repository access and can post publicly, the issue body becomes a viable control surface for data exfiltration. ### What happened Noma Labs disclosed GitLost on July 6, 2026, describing a prompt-injection attack against GitHub Agentic Workflows. Noma says the proof of concept used a normal-looking public issue to steer an AI agent into reading private repository content and publishing it in a public comment. ### Security context The Hacker News reports that the vulnerable setup involves an agent that can read untrusted issue text, access private repositories through a configured token and post output back to the public issue. The Register and SiliconANGLE covered the same disclosure, with The Register emphasizing that Noma framed the problem as an architectural limitation of credentialed agents rather than a conventional patch-only vulnerability. ### For practitioners The control plane matters more than the model brand. Scope agent tokens to the repository being triaged, avoid organization-wide read access for public-facing workflows, restrict which authors or events can trigger automation, and require review before an agent publishes content outside a trusted channel. ### What to watch Watch whether GitHub, model providers and agent framework vendors add stronger default isolation for issue-triggered workflows. Until then, the safest assumption is that public issue text, pull-request text and comments are untrusted input with the same severity as any other external payload. ## Key Points - 1GitLost turns ordinary public issue text into an exfiltration path when an agent has broad private-repository access. - 2The risk comes from workflow architecture, not just model behavior, because credentials and public output channels define the blast radius. - 3Teams should scope tokens narrowly, gate public agent output and treat issues, comments and pull requests as hostile input. ## Scoring Rationale GitLost is a major AI-security event because it demonstrates private-repository exfiltration through a public issue when agentic workflows hold broad credentials. The score remains high, but below industry-shaking, because the exposure depends on preview workflow configuration and the public evidence is a disclosed proof of concept rather than confirmed mass exploitation. ## Sources Public references used for this report. [01noma.securityGitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos](https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/) [02theregister.comGitHub AI agent leaks private repos when asked nicely](https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/5267924) [03thehackernews.comPublic GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data](https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html) ## View 6 more sources [04'GitLost' vulnerability let GitHub's AI workflows leak private repositoriessiliconangle.com](https://siliconangle.com/2026/07/07/gitlost-vulnerability-let-githubs-ai-workflows-leak-private-repositories/)[05GitHub's AI Agent Tricked Into Leaking Private Repository Datahackread.com](https://hackread.com/gitlost-github-ai-agent-leaking-repository-data/)[06GitLost: Tricking GitHub's AI Agent into Leaking Private Repositoriesthreatlandscape.io](https://threatlandscape.io/blog/gitlost-tricking-github-ai-agent-leaking-private-repositories)[07GitLost Vulnerability Tricks GitHub's AI Agent into Leaking Private Repositoriescybersecuritynews.com](https://cybersecuritynews.com/gitlost-vulnerability-github/)[08GitLost Attack Uses GitHub Issues to Exfiltrate Private Repo Data Through AI Agent Commentscyberpress.org](https://cyberpress.org/gitlost-attack-github-issues-data-exfiltration/)[09GitHub's AI Agent Tricked Into Leaking Private Repository Datasocdefenders.ai](https://www.socdefenders.ai/item/52f6a5bd-7de9-4532-8449-59dc1a020b7b) Practice interview problems based on real data 1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with. [Try 250 free problems](/problems)