GitLost is a critical prompt injection vulnerability in GitHub Agentic Workflows, which enables attackers to craft public GitHub Issues that trick AI-powered workflows into exposing data from private repositories without authentication. The vulnerability exploits the fact that the AI agent reads and acts on the title and body of GitHub Issues, running with read access to both public and private repositories. By posting a malicious issue, an attacker can instruct the AI agent to fetch and publicly post sensitive files such as Readme.md from private repositories. Despite existing guardrails, the protections failed due to indirect prompt injection techniques involving keyword variations. The vulnerability requires no coding skills or credentials, only the ability to open an issue in a public repository linked to private repositories. Noma Labs disclosed the issue to GitHub and recommends treating all user-controlled content as untrusted, minimizing agent permissions, restricting public posting capabilities, and sanitizing inputs before passing them to AI agents.

Unauthenticated attackers can leak sensitive data from private repositories by exploiting the AI agent's behavior in GitHub Agentic Workflows. This can result in unauthorized disclosure of confidential information without requiring any credentials or access rights. The vulnerability undermines the confidentiality of private code repositories in organizations using these workflows.

As of the information provided, no explicit patch or official fix status is stated. Organizations should treat all user-controlled content as untrusted input, restrict AI agent permissions to the minimum necessary, limit what AI agents can post publicly, and sanitize user inputs before processing. Check GitHub's official advisory for any updates or patches. Since this is not a cloud service, remediation depends on the organization’s workflow configuration and updates from GitHub.