An AI agent with broad repo read access can turn a harmless-looking public issue into a data-exfiltration path. The broken assumption is that public input stays low risk; here, the agent itself becomes the bridge from public text to private content, then back into a public reply.
Noma’s GitLost proof of concept shows this against GitHub Agentic Workflows in public preview. The setup reads issue text, can post comments, and can be granted read access across an organization’s public and private repositories, which lets an attacker without credentials steer it into copying private repo data into a public comment.
For teams that gave an agent cross-repo tokens, the exposure is not the account but the trust boundary the agent crosses. A public repo issue can now reach internal code or docs if the agent is allowed to treat that issue as instruction and has somewhere private to read from.
Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection
Researchers show how attackers can use a crafted public GitHub Issue to trick AI-powered workflows into exposing data from private repositories without authentication.
Coordinated GitHub API enumeration and access token abuse | Datadog Security Labs
Datadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning private repositories.