Disclosed vulnerability
GitLost: a public GitHub issue made GitHub Agentic Workflows leak private repository contents
AIR-2026-0156 AIR record · 2026-07-github-agentic-workflows-gitlost
From the supporting source
an unauthenticated attacker to silently pull data from private repositoriesnoma.security
The record
Disclosed
2026-07-07
Vendor
GitHub; Anthropic; Google
Product
GitHub Agentic Workflows (with GitHub Copilot coding agent, Anthropic Claude Code Security Review Action, Google Gemini CLI Action)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agentic workflow read private repos and posted the contents
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Data exfiltration, Private source code disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any organization running Agentic Workflows with org-scoped repository read access; no attacker credentials or code skills required
Capability abused
Defense & remediation
Recorded defense
GitHub's built-in agentic-workflow guardrails against acting on issue content
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Patched after responsible disclosure; the affected actions were vulnerable prior to April 2026
Taxonomy & references
Curator notes
Noma Labs. The attacker simply opens an issue in any public repo of a target organization; the workflow triggers on issue assignment, and an 'Additionally...' continuation slips past the guardrail, causing the agent to post private repository READMEs as public comments. Direct successor to the 2025 Invariant GitHub MCP finding, now realized in GitHub's own first-party CI agent. The exact patch date and any CVE were not stated on the cited page; a low-quality aggregator claims CVE-2026-44246 and active exploitation - that claim is quarantined separately and should not be merged here.
Supporting sources
Cite as
Enkrypt AI. "GitLost: a public GitHub issue made GitHub Agentic Workflows leak private repository contents". AIR, AIR-2026-0156. https://agentincident.vercel.app/i/AIR-2026-0156/ (accessed 2026-10-19).