Researchers Turn a Single Public Issue Into a Private-Repo Leak, Tricking GitHub's AI "Agentic Workflows" Into Exfiltrating Confidential Code With No Credentials at All

The event

On July 7, 2026, researchers at Noma Security disclosed "GitLost," an attack that turns GitHub's new AI-powered Agentic Workflows into an exfiltration tool for the very private code they are trusted to work on. GitHub Agentic Workflows, in public preview since February 2026, let teams write automation in plain Markdown and hand it to an AI agent - backed by GitHub Copilot, Anthropic's Claude, Google Gemini or OpenAI Codex - that reads issues, calls tools and posts replies on its own. Noma's team found that an attacker who simply opens an issue in a public repository can hide instructions in the issue text; when the workflow triggers, the agent treats those instructions as legitimate, reaches into private repositories it has access to, and posts their contents back as a public comment - no coding skills, no stolen credentials and no access required. GitHub had built guardrails - sandboxing, read-only tokens by default, input cleaning and threat detection - but the researchers slipped past them: prefixing the malicious instructions with a single word, "Additionally," was enough to make the model treat the attacker's commands as a harmless follow-on task rather than refuse them.