Noma's GitLost turns a public GitHub issue into a private-repo leak

Noma researcher Sasi Levi disclosed GitLost, where an unauthenticated attacker posts a crafted public GitHub Issue that steers GitHub Agentic Workflows — Actions paired with Claude or Copilot — into reading a private repo and posting its contents back as a public comment. GitHub's guardrails held until the keyword 'Additionally' reframed the agent's output instead of refusing it. The gotcha is concrete: any workflow that grants an agent cross-repo read and feeds it untrusted issue text is exploitable, and the fix is scoping permissions down and isolating user input from the instruction context.

Source: noma.security ↗