A single word, inserted into a public GitHub issue, is enough to bypass the security boundaries of GitHub Agentic Workflows. On July 6, 2026, Noma Security disclosed this vulnerability, dubbed GitLost, which allows an unauthenticated attacker to exfiltrate data from private repositories. The mechanism is straightforward: an attacker posts a crafted issue in a public repository, and the AI agent, which has been granted broad read permissions, processes the issue body as trusted instructions.
The vulnerability exploits the way these agents handle external input. By embedding malicious instructions within a public issue, an attacker can force the agent to access private repositories within the same organization and exfiltrate data by posting it as a public comment. The proof-of-concept demonstrated this by exfiltrating the contents of a README.md file from a private repository, sasinomalabs/testlocal, using a crafted issue in a public repository, sasinomalabs/poc.
Researchers found that GitHub’s existing safety guardrails were insufficient. By simply adding the keyword ‘Additionally’ to the malicious prompt, the model was tricked into reframing its output rather than refusing the request. This bypass highlights the fragility of current LLM defenses when faced with structured prompt injection. As Sasi Levi of Noma Labs noted:
The agent’s context window is also its attack surface. Any content the agent reads — whether issues, pull requests, comments, or files — can be weaponized if the agent treats that content as instructional input.
GitLost is a systemic issue within agentic architectures. It shares the same structural flaw as Agentjacking, which was disclosed by Tenet Threat Labs on June 17, 2026. While Agentjacking used Sentry error messages injected via the Model Context Protocol (MCP) to hijack coding agents, GitLost uses public GitHub issues as its injection vector. Both vulnerabilities stem from the same architectural failure: the tendency of agentic systems to treat external, untrusted data as trusted context.
The OWASP Agentic AI Top 10 classifies this type of vulnerability as ASI01 Agent Goal Hijack. It represents what is described as the ‘lethal trifecta’ of data access, untrusted content, and an exfiltration channel. Despite the severity of the flaw, GitHub did not issue a CVE, a security advisory, or a public statement. Instead, the company updated its documentation to describe the vulnerable workflow configuration. The absence of a CVE or formal security advisory indicates that the underlying architectural problem remains unaddressed, as the flaw is treated as a configuration limitation rather than a patchable software defect.
This pattern of MCP trust model failures is becoming increasingly common across the developer tool ecosystem. Noma Security has recently disclosed a series of similar vulnerabilities, including GrafanaGhost, DockerDash, Context Crush, and GeminiJack. These findings suggest that the industry is struggling to secure agentic workflows that rely on broad, implicit trust models. As Sasi Levi observed:
Prompt injection attacks have become, to agentic AI, what SQL injections were to web applications: a systematic, category-wide vulnerability class that requires the same systematic strategies and defenses.
GitHub’s recommended mitigations involve scoping agent tokens to single repositories, limiting public-facing workflow writes, restricting which authors’ content the agent acts on, and gating outputs behind mandatory human review. While these steps provide some defense, they do not resolve the fundamental issue of how agents distinguish between data and instructions. Current mitigations function only as stopgaps, as they do not address the core architectural requirement for separating untrusted data from executable instructions.