{
 "public_id": "AIR-2026-0156",
 "incident_id": "2026-07-github-agentic-workflows-gitlost",
 "date_disclosed": "2026-07-07",
 "date_occurred": null,
 "title": "GitLost: a public GitHub issue made GitHub Agentic Workflows leak private repository contents",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_github_issue",
 "agent_capability_abused": [
  "cross_repo_read",
  "issue_comment_write",
  "ci_pipeline_execution"
 ],
 "target_product": "GitHub Agentic Workflows (with GitHub Copilot coding agent, Anthropic Claude Code Security Review Action, Google Gemini CLI Action)",
 "target_vendor": "GitHub; Anthropic; Google",
 "autonomy_level": "fully_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "private_source_code_disclosure"
 ],
 "blast_radius": "any organization running Agentic Workflows with org-scoped repository read access; no attacker credentials or code skills required",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "unauthenticated_attacker",
   "ci_cd_agent",
   "guardrail_bypass",
   "cross_repo_scope_violation",
   "zero_credential"
  ]
 },
 "defense_present": "GitHub's built-in agentic-workflow guardrails against acting on issue content",
 "defense_bypassed": true,
 "fix_shipped": "Patched after responsible disclosure; the affected actions were vulnerable prior to April 2026",
 "primary_sources": [
  "https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos",
  "https://www.theregister.com/security/2026/07/07/github_ai_agent_leaks_private_repos/5267924"
 ],
 "verified_quote": "an unauthenticated attacker to silently pull data from private repositories",
 "confidence": "high",
 "notes": "Noma Labs. The attacker simply opens an issue in any public repo of a target organization; the workflow triggers on issue assignment, and an 'Additionally...' continuation slips past the guardrail, causing the agent to post private repository READMEs as public comments. Direct successor to the 2025 Invariant GitHub MCP finding, now realized in GitHub's own first-party CI agent. The exact patch date and any CVE were not stated on the cited page; a low-quality aggregator claims CVE-2026-44246 and active exploitation - that claim is quarantined separately and should not be merged here.",
 "risk_category": "privacy",
 "risk_secondary": [
  "product_misuse"
 ],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agentic workflow read private repos and posted the contents",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_github_issue",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}