One Word Bypassed GitHub’s AI Security — Your Private Repos Are at Risk
What if the biggest threat to your company’s secrets wasn’t a hacker in a hoodie — but a single word in a GitHub issue?
Researchers at Noma Security just demonstrated GitLost: a technique where a public GitHub issue tricks an AI agent into leaking your organization’s private repository contents. No stolen credentials. No network intrusion. Just one cleverly worded issue. 🎯
Here’s how it works: GitHub’s Agentic Workflows — AI agents that read issues and respond automatically — can be granted read access to your private repos for context. That’s the feature. That’s also the vulnerability.
An attacker opens a normal-looking issue on a public repo. Hidden inside is a prompt injection — instructions that look like legitimate tasks. When the AI agent processes the issue, it follows those instructions, pulls content from your private repos, and posts it as a public comment. 💀
GitHub built guardrails for exactly this. Sandboxing. Read-only tokens. Input cleaning. Threat detection. And Noma bypassed all of them with one word: “Additionally.”
Prefixing the malicious instruction with “Additionally” made the model treat it as a follow-on task, not something suspicious. The filter let it through.
This is what security experts call the “lethal trifecta”: an agent that can reach private data, takes in untrusted input, and has a way to send data out. Combine all three, and you have a leak path.
The uncomfortable truth? This isn’t a bug that gets patched. It’s a structural consequence of giving AI agents credentials while having them read attacker-reachable text. Until that changes, every organization using AI agents needs to ask: what can our agent see, and who can talk to it?
--
Source: The Hacker News
Date: 07 July 2026
Learn more about digital reputation protection and OSINT analytics — Confidence Guard Solutions.
--
Sources:
