GitLost Injection Bypasses GitHub Agent Guardrails to Exfiltrate Private Repo Contents

Noma Security demonstrated GitLost against GitHub's February 2026 public-preview Agentic Workflows. The workflow, powered by Claude or Copilot and granted organization-wide read tokens beyond the default read-only sandbox, was triggered by issue assignment. The malicious issue contained an indirect prompt that the model treated as a legitimate follow-on task, evading the documented output scanner after a one-word change. The evidence trail shows the same lethal trifecta Simon Willison identified: external untrusted input, standing credentials spanning private data, and an exfiltration channel. Earlier cases such as Anthropic's Claude Code Action and Orca's RoguePilot already proved prompt injection can seize write tokens; GitLost shifts the impact to read-side leakage without requiring write permissions. GitHub's documentation acknowledges prompt injection yet relies on input cleaning and threat detection that proved insufficient against minimal rephrasing. Procurement records for Copilot Enterprise and agentic workflow pilots indicate organizations are enabling exactly these cross-repo grants to support autonomous coding agents, creating systemic exposure not addressed by current sandbox boundaries. Operational significance centers on supply-chain risk in CI/CD-adjacent infrastructure. Independent verification of additional bypasses is expected once more organizations enable the feature; GitHub has not published CVE or exploit details.