GitHub AI workflows leak private data

Published July 8, 2026

GitHub's AI-powered workflows can accidentally expose private code from your repositories if an attacker posts a carefully crafted issue on your public-facing project. This happens because the AI reads public issues and may leak private data without you noticing.

Report priority
High
Targets
GitHub Agentic Workflows

How it works

An attacker posts a malicious issue to a public GitHub repository, tricking the AI workflows into revealing private code from private repositories without needing a login.

What to do

Check if you use AI workflows in any of your repositories by looking at your project settings under Workflows.

Disable AI workflows in your repositories until GitHub fixes this issue, or review all public issues for unexpected private data leaks.

Technical details

Affected software: GitHub Agentic Workflows

An attacker creates a fake issue in your public GitHub project with a sneaky prompt designed to trick the AI. When the AI processes it, it accidentally pulls private details from your private repos and posts them in the issue comments. You only see the leak when you check the issue later.

Researchers at Noma Security (lead Sasi Levi) disclosed "GitLost," an indirect prompt injection flaw in GitHub Agentic Workflows, a public-preview feature that pairs GitHub Actions with an AI agent (backed by Copilot, Claude, Gemini, or Codex) driven by Markdown instructions. An unauthenticated attacker opens a public Issue with hidden instructions; when a workflow assigns it to the agent, the agent treats the Issue text as a command rather than untrusted input. Because the agent's token had cross-repo read access including a private repo, it pulled the private README and posted it as a public Issue comment.

GitHub's output guardrail was bypassed by prefixing the injected request with "Additionally," reframing it as a follow-on task. No CVE/GHSA ID has been assigned. There is no code patch; GitHub has not yet published mitigation documentation as of the report date.

References

View Original Source