"GitLost": a single public comment can trick a GitHub AI agent into leaking your private files: why it is not safe to use
Researchers showed a hidden note in a public GitHub comment can make an AI agent read and leak files from private repositories it can access.
What happened
On July 8, 2026, security firm Noma Labs disclosed a flaw it calls "GitLost" in GitHub's Agentic Workflows, the AI agents that automatically handle repository tasks. An attacker with no account and no coding skill can hide instructions inside a public GitHub Issue (a public note anyone can post on a project). Those hidden instructions trick the AI agent into reading files, such as a private project's README, and exposing them. This is called prompt injection: sneaking commands into ordinary text that the AI then obeys. The researchers slipped past GitHub's safety checks just by starting their request with the word "additionally." Noma Labs reported the flaw to GitHub privately before going public.
What it means for you
If an AI agent can reach your private files, anything it reads from an untrusted source, like a public comment, could be turned against you. You do not have to click anything or make a mistake yourself.
What to do instead
- Limit what your AI agents can access. Give them only the files and repositories a task truly needs.
- Treat any content from strangers, comments, issues, tickets, as untrusted input, not as commands.
- Prefer tools that are reviewed and tested. AgentPod lists only skills that have been checked and tried before they appear, which reduces surprises without claiming to remove all risk.
Sources
- https://www.securityweek.com/critical-vulnerability-exposes-github-agentic-workflows-to-prompt-injection/
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.