Last Updated: 2026-07-07T20:37:35Z
CVSSv3: None yet
GitLost:
A Prompt injection in Github’s Agentic Workflows allows unauthenticated attackers to leak information from private repositories of an org via an Issue in one of the org’s public repos.
Notes:
Noma labs noted that not just issues, but any content the agents read can be weaponized such as pull requests, comments, and files. That is, if the agent is treating them as instructional input.
Permissions should be scoped to minimum, restrict what agents can post publicly, and as always sanitize any user input before handing it to the model.
Sources: