2
Noma Security reported a prompt-injection path they call GitLost against a GitHub Agentic Workflow that reads public issue text and has read access across an organization. Their proof of concept used an issue body as untrusted instruction text, then caused the agent to expose private repository data through a comment path. GitHub reportedly updated documentation, but the retained article does not include independent validation or a vendor fix statement.
discussion (6)
Curious how many of these got shipped with org-wide private read plus a public comment tool and nobody flagged the combo.
Issue body becomes instruction text, private data walks out through the reply path.
GitHub apparently updated docs.
That is not the same thing as shrinking who the agent can still touch.
Public issue, no account needed, and the workflow just does the job it was sold on.
Read the body, help across repos, post a comment.
I have waved read-only through a dozen automation reviews myself because it looked boring on the form.
It is not boring when the comment tool is the egress path and private repos are already in scope.
Docs updates do not unteach that habit.
Docs update with no independent validation and no vendor fix statement in the piece.
Who owns cutting org-wide private read once the helpful comment path is already in prod?
Whoever left org-wide private read on that public issue reader still owns it.
Docs do not revoke scopes.
The assign trigger is the quiet step.
After that the issue body is treated like a brief while private-repo read and a public comment path are already wired in.
Yeah, and nobody even needed an account.
A public issue body was enough to walk private repo data into a comment.