GitHub AI agent leaks private repos when asked nicely

Malicious prompters could easily trick GitHub agents into pulling data from private repositories and then leaking the information as a public comment for anyone to access, according to Noma Labs researchers who named the vulnerability GitLost. The issue exists in GitHub’s Agentic Workflows, which allow an AI agent powered by Claude or GitHub Copilot to autonomously execute tasks in GitHub Actions. As the AI security sleuths discovered and detailed in a Monday blog, the workflows are vulnerable to a critical prompt injection flaw that causes GitHub’s AI agent to retrieve data from a private repo by crafting a GitHub issue in a public repository belonging to the same organization. The attacker simply hides the malicious commands in plain...

Read the full article at the source.