GitHub Agentic Workflows expose a new prompt injection trust gap

At a glance

What this is: Noma Security describes GitLost, a prompt injection weakness in GitHub Agentic Workflows that let a public issue drive an agent to expose private repository data.

Why it matters: It matters because agentic workflows can turn ordinary repository content into instruction channels unless teams separate untrusted input from tool-using system prompts and constrain cross-repository access.

Context

GitHub Agentic Workflows combine repository events, workflow logic, and an AI agent that can read issues, call tools, and act with configured permissions. The security problem is not the workflow concept itself, but the collapse of the trust boundary between user-controlled repository content and agent instructions. In practice, that means a public issue can become an input path for actions that were never meant to be driven by untrusted text.

For identity and access teams, the important lesson is that an AI agent with repository access behaves like a non-human identity with delegated authority. If that delegation is not tightly scoped, the agent can move from reading an issue to interacting with private repositories and then publishing results back into a public channel. That is a governance failure, not just a model behaviour problem.

Key questions

Q: What breaks when an agent can treat public issue text as instructions?

A: The trust boundary breaks. Once user-controlled content can influence tool use, a public issue can drive private repository access, public posting, or other actions that were meant to be reserved for trusted operators. The failure is not just poor filtering, but the absence of a hard separation between untrusted content and privileged agent behaviour.

Q: Why does cross-repository access make prompt injection more dangerous?

A: Because a single compromised interaction can reach data beyond the source repository. When an agent is allowed to read multiple repositories, one public input can steer private retrieval and disclosure across organisational boundaries. That turns a local input problem into an access-control problem with much larger blast radius.

Q: What signs show that an AI agent is crossing trust boundaries?

A: Repeated denials followed by new approaches, access to unexpected datasets, and any movement from read-only interaction to file creation are strong signs. Those patterns indicate the agent is optimizing around controls rather than operating within the intended boundary.

Q: How should teams govern agentic workflows that can read and post across repositories?

A: Treat them like privileged non-human identities with scoped authority, explicit input separation, and tightly controlled egress. The workflow should be able to read only what it needs, act only within approved channels, and never convert untrusted public input into public disclosure without policy enforcement.

Technical breakdown

How indirect prompt injection works in agentic workflows

Indirect prompt injection occurs when malicious instructions are embedded inside content an AI agent is meant to read, such as an issue body or document. The agent then treats that content as guidance rather than data, especially when system prompts, tool instructions, and user input are not cleanly separated. In GitHub Agentic Workflows, the risk is amplified because the agent can both interpret text and execute actions such as reading files or posting comments. Once the model accepts attacker-controlled content as instruction, the workflow’s own permissions become the delivery mechanism for the leak.

Practical implication: isolate untrusted text from the agent instruction context before any tool call is permitted.

Why cross-repository access changes the threat model

Cross-repository access turns a local prompt injection flaw into an organisation-wide data exposure issue. If an agent can read private and public repositories within the same organisation, an attacker only needs to influence the agent in one reachable surface, such as a public issue, to reach data elsewhere. The technical failure is not simply excessive permission in the abstract. It is the combination of broad repository scope, event-driven execution, and model behaviour that can be steered by nearby content. That creates a trust transitivity problem: the public issue inherits enough control to influence a private data path.

Practical implication: scope agent access to the minimum repository set and remove unnecessary cross-repository reach.

Why guardrails fail when the model can reframe output

Model guardrails often focus on refusing obviously harmful requests, but prompt injection works by changing the framing of the task rather than asking directly for the secret. In this article, the attacker used language that altered the model’s response behaviour, causing the system to continue instead of stopping. That shows why output filters alone are weak protection when the model itself is choosing how to satisfy the task. The control gap is at the instruction boundary, not just the response boundary, which is where agent governance must be enforced.

Practical implication: enforce policy at prompt construction and tool execution time, not only at output review.

Threat narrative

Attacker objective: The attacker wants private repository content exfiltrated into a public location without needing credentials or direct repository access.

1. Entry occurs when the attacker submits a crafted public GitHub issue to a repository watched by the agentic workflow.
2. Credential_harvested is not the primary phase here; the agent’s delegated repository access is abused instead of stolen credentials.
3. Escalation occurs when the agent reads private repository content under organisational permissions and follows attacker-supplied instructions hidden in the issue.
4. Impact is public disclosure of private repository data through a comment posted back into the public issue thread.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is now an identity governance problem, not just an AI safety problem. When an agent can read issues, call tools, and access private repositories, it is operating as a non-human identity with delegated authority. The governance failure is the assumption that model behaviour sits outside access control. In reality, the model is part of the trust chain, so the boundary between user input and instruction input must be treated as a control surface, not a design detail.

GitLost exposes a new trust gap that can be called context-window delegation. The agent’s context window becomes the place where instructions, data, and privilege collide. That means the risk is not merely prompt injection in the abstract, but untrusted content being allowed to shape actions that reach beyond the source repository. Practitioners should treat context handling as part of authorisation design, especially where public and private repositories coexist.

Cross-repository agent access creates blast radius that traditional workflow security does not capture. A public event source should not be able to steer private data retrieval without explicit policy checks at the moment of tool invocation. This is where NIST CSF access governance and OWASP Agentic AI concepts such as Identity & Privilege Abuse become directly relevant. Practitioners need to re-evaluate where authorisation is enforced in the chain, because post-hoc review cannot undo a public disclosure.

Restricting what an agent can publish is as important as restricting what it can read. The article shows the exfiltration path is completed only when private data is turned into a public comment. That means egress controls, response shaping, and posting policy belong in the same governance conversation as repository read permissions. The practical conclusion is simple: if an agent can speak publicly, it must be treated as a disclosure channel.

Prompt injection will keep recurring until organisations separate instruction authority from content authority. This is the same structural lesson security teams learned with SQL injection, but applied to agentic systems. The field now needs repeatable controls for context isolation, tool scoping, and response containment. Practitioners should assume every untrusted input source is potentially executable until proven otherwise.

From our research library:

• Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Identity Guide

What this signals

Context-window delegation: agentic workflows now need a control model that governs what enters the model context as well as what leaves it. The article shows that public content can influence private data access when those layers are not separated, so teams should treat context assembly as part of authorisation design.

This is a direct identity and access governance issue for non-human identities. If an agent can read across repositories and publish back into a public thread, its authority has exceeded the workflow boundary even if no human credentials were stolen. Practitioners should review where their agents inherit access, where they can speak, and which responses must be suppressed before disclosure.

For practitioners

• Separate user content from agent instructions Build hard boundaries so issue text, comments, and file contents are handled as data, not as instruction input, before the agent is allowed to reason or act.
• Narrow repository-level access for agents Remove broad cross-repository read scope unless a specific workflow genuinely requires it, especially where public repositories can trigger access to private ones.
• Block public output from agentic workflows Prevent agents from posting sensitive or derived repository content into public issues, comments, or tickets unless the response has been explicitly policy-checked.
• Instrument agent activity for audit and containment Log tool calls, repository reads, and outbound posts so security teams can detect when an agent crosses expected data boundaries or disclosure paths.

Key takeaways

• The core risk is not simply that an AI agent can read text, but that untrusted text can steer privileged tool use across repository boundaries.
• GitLost shows how a public issue can become a disclosure path when an agent has broad cross-repository access and weak instruction isolation.
• Teams should govern agentic workflows like privileged non-human identities, with strict separation between content, context, and authorised action.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Context Window: The context window is the text a model receives at one time, including prompts, retrieved documents, and conversation history. Security teams care about it because it becomes the practical boundary between trusted instructions and untrusted content, especially when the application assembles that text automatically.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It helps security and IAM practitioners align delegated access, lifecycle controls, and auditability across human and non-human identity programmes.