"GitLost" Leaks Private Repositories via GitHub Agentic Workflows

GitHub Agentic Workflows (public preview; agents running on Copilot, Claude, Gemini, or Codex inside GitHub Actions)

An unauthenticated attacker files a public GitHub issue containing hidden plain-English instructions; when the workflow triggers, the credentialed agent (which can read repositories the attacker cannot) follows them and posts private repository contents into a public comment. The proof of concept exfiltrated a private repo's README into a public comment, and prefixing the injection with "Additionally" bypassed GitHub's threat-detection guardrails

The agent cannot distinguish owner instructions from attacker-planted content in an untrusted issue (the "lethal trifecta" of private-data access, untrusted input, and a public output channel); GitHub describes it as an architectural limitation rather than a patchable bug. Found by Noma Security