How a GitHub AI Agent Could Be Tricked Into Speaking for an Attacker

GitHub’s agentic workflows are meant to reduce repetitive work by letting AI read Issues, draft replies, and coordinate routine actions. But the GitLost finding from Noma Security shows how quickly that convenience can become a security problem when user-controlled text and privileged actions sit in the same loop.

What the report describes

According to the material, the workflow is triggered by an issues.assigned event. It reads the Issue title and body, then uses an add-comment tool to post a response. At the same time, it can access other repositories within the organization, including private ones. That combination creates a powerful target: an attacker only needs to open a public Issue in an organization-owned repository and embed hidden instructions.

Noma says the attack does not rely on advanced hacking skills, valid credentials, or internal access. In the reported test, even a small cue such as the word “Additionally” was enough to push the model into unexpected behavior, making it treat restricted information as something it could surface in a public reply.

Why this matters

• Prompt injection becomes a systems issue. Once an agent can read, decide, and act, a bad instruction is no longer just a bad answer; it can become a data leak.
• Excessive permissions are the real risk multiplier. A model connected to too many repositories or too much context becomes a high-value target.
• User input should not be trusted as instructions. Public Issues, comments, and similar text need to be isolated from system prompts and operational commands.
• Public output needs explicit guardrails. Even if an agent can access sensitive content, it should not be allowed to echo it back in a public channel.

The broader takeaway

This case pushes AI security beyond the model itself and into workflow design. Traditional software security assumes the trust boundary is enforced by code and access control. In agentic systems, the model becomes part of that boundary, which means governance must cover prompt handling, tool permissions, repository scope, and disclosure rules at the same time.

The practical lesson for teams is simple: private repositories are not a safe boundary if an agent can reach them. Limit permissions to the minimum, separate user content from instructions, and restrict what an agent can reveal publicly. Otherwise, an AI assistant can become an unintentional exfiltration path.

InfoQ 中文