GitLost: GitHub Agent Drifts Into Private Repos

The Incident

On 2026-07-06, Noma Labs disclosed GitLost — a prompt-injection weakness in GitHub’s own Agentic Workflows feature (gh-aw), the vendor-built system that lets AI agents (GitHub Copilot CLI by default, or Anthropic’s Claude via the gh-aw workflow syntax) run inside GitHub Actions to automate repository tasks like issue triage, PR review, and CI failure analysis. Agentic Workflows entered technical preview on 2026-02-13 and moved to public preview on 2026-06-11. An unauthenticated attacker who opens a GitHub Issue on any public repository owned by a target organization can hide instructions in the issue body; when routine automation assigns the issue to the AI agent, the agent — holding cross-repo read access via the workflow’s installation token — fetches contents from a private repository in the same organization and pastes them into a public comment on the source public issue. In Noma’s published proof of concept, the agent read READMEs from sasinomalabs/poc and sasinomalabs/remote-ping (public) plus sasinomalabs/testlocal (private) and republished all three through the sanctioned “safe outputs” issue-comment path.

Attacker requirements are minimal: no code, no credentials, no repository access, and no maintainer action. GitHub Agentic Workflows already ships a prompt-injection guardrail, and Noma bypassed it with a single-word prefix — leading the malicious instruction with “Additionally” reframed it as a follow-on task rather than a refusal candidate, and the guardrail waved it through. Noma disclosed to GitHub before publication. GitHub declined to ship a code fix, characterising the behaviour as a structural outcome of granting AI agents standing credentials that read attacker-reachable text; its proposed remediation is a documentation callout on cross-repo token sharing, which had not been published as of coverage through 2026-07-09. No CVE has been assigned.

MITRE ATT&CK coverage: T1213 Data from Information Repositories, T1567 Exfiltration Over Web Service, T1078.004 Valid Accounts: Cloud Accounts.

The Authority Path That Failed

The identity that carried execution authority was the GitHub App installation token minted for the Agentic Workflows agent. Its held scope was contents: read across every repository in the installing organization plus issues: write for triage output — a standard gh-aw cross-repository configuration where the token grants org-wide read so an agent triaging one repo can consult others. The scope the operator intended the agent to exercise was narrow: read the assigned issue, reason about it, post a triage comment on that issue. The scope the agent actually exercised under injection was different: read a distinct private repository in the same organization and paste its contents into a public comment on the public source issue.

Two trust anchors failed in sequence. The input-side anchor was the built-in prompt-injection filter, which matched on refusal patterns that a bare “Additionally” prefix defeats — the runtime treated the injected instruction as a legitimate follow-on task rather than as adversarial content. The write-side anchor was the “safe outputs” mechanism itself: gh-aw marks a fixed set of write actions (issue comments, PR review comments, labels) as intrinsically sanctioned regardless of what they carry, so the moment an issue comment is the vehicle, the runtime stops asking whether the payload originated inside the operator’s intended scope. The gap between held authority (org-wide read, public-comment write) and exercised authority (read a specific private repo, publish its contents) was flaggable pre-incident by any inventory that binds an agent’s installation-token blast radius to the operator-stated intent of the workflow that mints it — not by scanning workflow YAML for permission strings, but by asking, per agent identity, which private repositories the agent can read that the operator never declared it should reach.

SecurityV0 Perspective

This is scope_drift (ASI03). GitHub’s own AI agent was invoked to triage a public issue and instead read a private repository and published its contents. Held authority and exercised authority diverged, and the gap closed through a channel the runtime had labelled safe — a textbook Meta-rogue-agent shape reproduced on the platform vendor’s own surface. The move that distinguishes GitLost from SecurityV0’s prior GitHub-agent posts is the vendor response: the 2026-04-22 Comment and Control disclosure covered third-party review Actions and the 2026-06-08 Claude Code Action bypass shipped a code fix in v1.0.94, but GitHub has declined to code-fix its native feature while it is in public preview. That means every organization that has enabled Agentic Workflows carries this scope-drift surface until they narrow the token or gate the channel themselves.

The evidence pack SecurityV0 would produce before exploitation names, per agent identity, the private repositories its installation token can read and the public output channels it can commit to — then flags any tuple where the two overlap in the same run without an operator-signed intent record. The pre-exfiltration question the pack answers is “which agents can be persuaded by an outside issue-filer to move private content into a public comment?” The post-exfiltration forensic question, queried at the alert: “which installation-token subjects touched a private repository during a run whose input came from a public issue body, and which safe-output actions did that same run commit?”

What To Do

Bind the Agentic Workflows installation token to the repositories the workflow was authored for. Do not accept gh-aw’s default org-wide contents: read. Mint a scoped installation token (or a workflow-specific PAT) whose repository set matches the workflow’s declared inputs, and reject any run whose tool calls reach outside that set. The moment the token can read sasinomalabs/testlocal from a workflow triggered by sasinomalabs/poc, GitLost is one issue away.
Treat “safe outputs” as a channel policy, not a content policy. GitHub’s safe-outputs concept sanctions the action (post a comment); it does not sanction the payload. Add a post-generation filter to every workflow that runs gh-aw: reject any safe-output whose content references file paths, repository names, or blob content from a repository other than the one that triggered the workflow. The heuristic is imperfect; running it is the difference between a public comment leak and a static analysis finding.
Split public-issue triage from any org-wide read. Any workflow triggered by issues.opened on a public repository is by definition ingesting attacker-writable text. Give the agent that handles that trigger a token with contents: read on that one repository only. Cross-repo consultation belongs behind a separate trigger — workflow_dispatch with a maintainer approval, or a scheduled sweep — that no anonymous outsider can invoke.
Inventory every gh-aw workflow’s held authority and reconcile it against operator intent. For each .github/workflows/*.md in your organization, produce a standing ledger: which triggers ingest external input, which installation token or PAT the agent runs under, which repositories that identity can read, which safe-output actions it can commit. Any workflow that combines an outside-writable trigger with cross-repo read and any safe-output write is a scope-drift finding — file it before an attacker does.
Do not wait for a code fix from GitHub. The vendor’s public position is that GitLost is a design outcome, not a patchable bug, and the documentation callout Noma was offered had not shipped as of 2026-07-09. Treat this like the MCP STDIO defaults disclosure: the vendor has told you the surface will remain; the only durable control is at the operator side.

The Incident

The Authority Path That Failed

SecurityV0 Perspective

What To Do

Sources