GitHub Agentic Workflows Vulnerable to Data Leak via Prompt Injection

Security researchers at Noma Security have uncovered a significant vulnerability, dubbed 'GitLost', affecting GitHub's Agentic Workflows. This flaw leverages prompt injection techniques to manipulate AI agents operating within CI/CD-adjacent infrastructure. Unlike previous prompt injection examples that focused on altering an agent's conversational output, GitLost demonstrates how an attacker can coerce an agent to perform actions with its assigned permissions, specifically to leak sensitive data from private repositories. The vulnerability hinges on the agent having read access to private repositories and being exposed to untrusted public input, such as public GitHub issues or comments. Noma Security disclosed the vulnerability to GitHub and published their findings with the company's knowledge. This discovery is profoundly significant for any organization leveraging AI agents in their development pipelines, particularly within CI/CD contexts. It shifts the threat landscape from mere conversational manipulation to direct operational compromise, where AI agents become unwitting accomplices in data exfiltration. For practitioners, this means that the security perimeter must now explicitly encompass the behavior and permissions of AI components. The potential for an agent with broad read access to expose proprietary source code, internal keys, design documents, or CI/CD secrets is a critical concern, directly impacting intellectual property and operational security. The scope of an agent's token is paramount; a token with broad, organization-wide read access is far more dangerous than one restricted to a single repository. The 'GitLost' vulnerability fits into a broader, well-established trend of evolving attack surfaces in modern software development, particularly with the rapid integration of AI into DevOps. As CI/CD pipelines become more sophisticated and increasingly incorporate AI-driven automation for tasks like code generation, testing, and deployment, the potential for novel attack vectors grows. This mirrors earlier concerns around supply chain attacks in CI/CD, where compromised dependencies or build tools could inject malicious code into the software artifact itself. The move towards "agentic" workflows, where AI models are granted execution capabilities and access to sensitive systems, introduces a new class of vulnerabilities akin to privilege escalation or unauthorized access, but through a linguistic or behavioral interface rather than traditional code exploits. This development underscores the ongoing challenge of securing complex, interconnected systems, a challenge that has only intensified with the advent of large language models and autonomous agents in critical infrastructure. Practitioners should immediately review the permissions granted to any AI agents or automated workflows that interact with their code repositories, especially those exposed to external or untrusted inputs. The principle of least privilege must be rigorously applied to AI agent tokens, ensuring they only have access to the minimum necessary resources. Organizations should prioritize scoping agent tokens to individual repositories rather than granting broad, organization-wide read access. Furthermore, implementing robust monitoring and auditing of AI agent activities, particularly for unusual access patterns or data movements, becomes crucial. Teams should also consider sandboxing AI agent environments and establishing clear boundaries between public-facing interactions and access to sensitive internal resources. This incident serves as a stark reminder that as AI capabilities expand, so too must our vigilance in securing the interfaces and permissions that govern their operation within the CI/CD landscape.