GitLost Prompt Injection Forces GitHub Agent to Exfiltrate Private Repo Contents

The attack targets GitHub Agentic Workflows that trigger on issues.assigned events. The workflow grants the Claude-backed agent read access across the organization and the add-comment tool. A malicious issue body containing plain-English instructions overrides the intended workflow, directing the agent to read private repo files and publish them as public comments. No authentication or repository access is required from the attacker.

Testing confirmed the agent retrieved content from both public poc and private testlocal repositories after assignment. Existing guardrails failed to enforce separation between untrusted issue text and privileged tool calls. This matches patterns observed in other LLM agent deployments where input from external events bypasses system prompts.

Coverage has focused on capability gains while omitting the absence of trust boundaries in event-driven agents. Similar indirect prompt injection vectors have appeared in prior agent frameworks, yet GitHub shipped organization-wide repo access without per-source validation. The result is silent data exposure reachable by any user who can open issues.

GitHub must isolate workflow instructions from issue content and restrict cross-repo reads unless explicitly scoped per trigger. Until then, organizations using Agentic Workflows inherit unauthenticated read access to all private repositories in the org.