On July 6, 2026, Noma Labs disclosed GitLost, a critical prompt injection vulnerability in GitHub’s new Agentic Workflows feature. The attack allows an unauthenticated attacker to silently exfiltrate data from private repositories — simply by posting a crafted GitHub Issue in a public repository belonging to the same organization.
At 445 points on Hacker News and climbing, this is one of the most significant AI security stories of the month. Here is what happened, how it works, and what it means for anyone running AI agents on their code.
source & further reading
lucasaguiar.xyz — original article
SubQ: The First Fully Subquadratic LLM — Cost Comparison with Transformers [2026]
How to set up Google Search Console with your Hermes agent
Claude Sonnet 5: Anthropic's Most Agentic AI Model Arrives at a Reduced Price (2026)