GitLost: GitHub Vulnerability Lets AI Agents Leak Data From Private Repositories

In July 2026, researchers at Noma Labs published details of a vulnerability in GitHub that they have named GitLost. According to their description, certain requests can cause GitHub's AI agents to extract data from private repositories and publish it as public comments that any user on the platform can read.

How the GitLost vulnerability works

GitLost is a prompt injection attack, a class of attack in which malicious instructions are injected into a request sent to an AI agent.

The exploit takes advantage of how GitHub's AI agents operate. The agents run with the access rights of a user or organization and can work across several repositories at once. An attacker crafts a request by embedding hidden instructions in publicly visible content. When the agent processes that content, it reads from a private repository and writes the data somewhere public: a comment on an issue or a pull request.

Key facts about the vulnerability:

• Noma Labs discovered the vulnerability, which has been officially named GitLost
• GitHub's AI agents publish data from private repositories as public comments
• The attack vector is prompt injection: a malicious instruction is disguised as a legitimate request
• Organizations where AI agents have access to several repositories at once are at risk

Why this class of attack is dangerous

Prompt injection differs from classic vulnerabilities in one key way. The attacker doesn't break into the infrastructure directly. Instead, they "persuade" the agent to take an unwanted action. Since AI agents gained the ability to act autonomously, reading files, executing code, and posting comments, the attack surface of developer platforms has grown considerably.

Security systems don't flag anything unusual during a prompt injection attack. The agent behaves normally and acts on behalf of an authorized user. Technically, it is "doing what it was asked," except the request came from an attacker rather than a legitimate user.

The stakes are especially high for GitHub. Companies keep proprietary code, configuration files containing secrets, and internal documentation in private repositories. At the same time, AI agents from the GitHub Copilot ecosystem are growing in popularity, and many teams grant them broad permissions without conducting a full risk assessment.

What do developers lose in a leak?

If GitLost is successfully exploited, an attacker can read the contents of a private repository through an open public comment. Depending on what the repository holds, the following are at risk:

• source code for proprietary projects and algorithms
• API keys, tokens, and passwords from configuration files (.env, secrets.yml, and similar)
• internal communications: discussions in issues and pull requests, technical details, business context

The leak's stealth is a particular problem. Because the agent operates normally, the incident is hard to detect in corporate SIEM systems: there are no hijacked accounts, no malicious files, and no obvious signs of compromise.

What this means

GitLost clearly illustrates a systemic weakness in AI agents: the broader their access rights, the more damage a successful injection can do. Organizations using AI agents on GitHub should immediately review agent permissions, restrict them according to the principle of least privilege, and watch for official guidance and patches from GitHub.