GitLost vulnerability on GitHub: AI agents leak data from private repositories

Researchers from Noma Labs in July 2026 published findings about a vulnerability on the GitHub platform, named GitLost. According to the report, GitHub AI agents can extract data from private repositories under certain requests and publish them as open comments accessible to any user of the platform.

How GitLost Works

GitLost belongs to the class of prompt injection attacks — injection of malicious instructions into a request to an AI agent.

The exploitation mechanism is based on the features of how GitHub AI agents work. Agents operate with the access rights of a user or organization and can access multiple repositories simultaneously. An attacker creates a specially crafted request — embedding hidden instructions in publicly visible content — and when the agent processes it, it accesses the private repository and outputs data where it becomes publicly available: in a comment on an issue or pull request.

Key facts about the vulnerability:

• The vulnerability was discovered by Noma Labs and officially named GitLost
• GitHub AI agents publish data from private repositories as open comments
• Attack vector — prompt injection: malicious instructions are disguised as a legitimate request
• At risk are organizations where AI agents have access to multiple repositories simultaneously

Why This Class of Attacks Is Dangerous

Prompt injection differs from classical vulnerabilities in that the attacker does not compromise the infrastructure directly, but instead 'convinces' the agent to perform an undesirable action. Since AI agents gained the ability to act autonomously — read files, execute code, publish comments — the attack surface on development platforms has significantly expanded.

Security systems do not detect anomalies during prompt injection: the agent operates in normal mode, on behalf of an authorized user. Formally, it 'does what was asked', although the request came not from a legitimate user, but from an attacker.

For GitHub, the situation is particularly sensitive: companies store proprietary code, configuration files with secrets, and internal documentation in private repositories. Meanwhile, AI agents from the GitHub Copilot ecosystem are gaining popularity, and many teams grant them broad permissions without conducting a full risk audit.

What Developers Lose if a Leak Occurs

If GitLost is successfully exploited, an attacker gains access to the contents of a private repository through an open public comment. Depending on what is stored there, the following are at risk:

• Source code of proprietary projects and algorithms
• API keys, tokens, and passwords from configuration files (.env, secrets.yml, and similar)
• Internal correspondence: discussions in issues and pull requests, technical details, business context

A particular problem is the imperceptibility of the leak. Since the agent operates in normal mode, the incident is difficult to detect in corporate SIEM systems: there are no compromised accounts, no malicious files, no obvious signs of compromise.

What This Means

GitLost is a clear example of a systemic vulnerability in AI agents: the broader their access rights, the more destructive a successful injection can be. Organizations using AI agents on GitHub should immediately review agent permissions, restrict them according to the principle of least privilege, and monitor official recommendations and patches from GitHub.