GitLost: How Prompt Injection Leaks Private GitHub Data

Researchers at Noma Labs identified a vulnerability called GitLost that allows attackers to leak private GitHub repository data via prompt injection. By placing malicious instructions in public repository issues, attackers can trick GitHub's AI agents into exposing sensitive files. The exploit demonstrates the critical need for better input isolation and least-privilege permissions in AI-driven automation.

Key Points

• GitLost is an indirect prompt injection vulnerability affecting GitHub's AI-powered Agentic Workflows.
• Attackers can trigger the exploit by simply posting a crafted issue in a public repository without needing any credentials.
• The vulnerability allows AI agents to be manipulated into leaking data from private repositories they have permission to access.
• Researchers bypassed GitHub's security guardrails by using specific linguistic triggers to reframe the agent's output.
• The discovery emphasizes that an AI agent's context window serves as its primary attack surface.

Sentiment

The overall sentiment is skeptical but mostly aligned with the article's core warning. Hacker News broadly agrees that agentic systems become dangerous when public prompts, private data, and external outputs are connected without hard authorization boundaries. The disagreement centers less on whether the risk exists and more on whether the article fairly attributes blame to GitHub, whether this is a novel vulnerability or an obvious misconfiguration, and how much of the problem can be mitigated without reducing agent usefulness.

In Agreement

• Prompt injection is a systemic class of agent security failure because current LLMs do not reliably separate trusted instructions from untrusted content.
• The GitLost setup matches the dangerous combination of untrusted input, sensitive data access, and a channel for public output, making exfiltration unsurprising but still serious.
• Guardrails written as prompts, or enforced by another model, are too weak to protect private repositories from a determined attacker.
• Agents should run with least-privilege credentials, scoped APIs, sandboxing, and deterministic RBAC rather than broad organization-level access.
• GitHub and similar platforms should make risky agent configurations harder to create and clearer to reason about, especially when public issues can trigger workflows with private data access.

Opposed

• Some commenters argue the article overstates novelty because the described failure follows directly from granting an agent private-data access while letting public users influence its behavior.
• Several participants frame the issue as a permissions or tool-design bug rather than a uniquely GitHub or model-level vulnerability.
• Some say the SQL injection analogy is misleading because SQL injection has mature structural fixes while prompt injection currently lacks an equivalent prepared-statement-style boundary.
• Others argue that scoped tokens, existing GitHub settings, and careful workflow configuration can already prevent the particular cross-repository leak scenario.
• A few commenters view the article's naming, branding, and tone as marketing for a security vendor more than a disclosure of a surprising technical result.