An AI agent with broad repo read access can turn a harmless-looking public issue into a data-exfiltration path. The broken assumption is that public input stays low risk; here, the agent itself becomes the bridge from public text to private content, then back into a public reply.
Noma’s GitLost proof of concept shows this against GitHub Agentic Workflows in public preview. The setup reads issue text, can post comments, and can be granted read access across an organization’s public and private repositories, which lets an attacker without credentials steer it into copying private repo data into a public comment.
For teams that gave an agent cross-repo tokens, the exposure is not the account but the trust boundary the agent crosses. A public repo issue can now reach internal code or docs if the agent is allowed to treat that issue as instruction and has somewhere private to read from.