Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: Noma Labs says a critical prompt injection flaw in GitHub Agentic Workflows, called GitLost, let an unauthenticated attacker use a crafted public issue to pull data from private repositories by exploiting the agent’s trust boundary, according to Noma Security. The case shows how agent context windows become attack surfaces when untrusted content can drive tool use and cross-repository access.
NHIMG editorial — based on content published by Noma Security: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when an agent can read untrusted repository content as if it were instructions?
A: The trust boundary breaks first.
Q: Why do AI workflows complicate IAM and NHI governance?
A: AI workflows complicate governance because they increase the number of actions, permissions, and delegated decisions happening in a shorter time window.
Q: How do security teams know whether an agent is operating inside its intended boundary?
A: They need evidence for both intent and execution.
Practitioner guidance
- Restrict agent read scopes to the minimum viable repository set Review every GitHub Agentic Workflow that can reach across repositories and remove private repository access unless a documented use case requires it.
- Separate untrusted issue content from system instructions Insert a sanitisation and isolation layer before prompt assembly so the agent cannot treat issue text, comments, or attachments as instructions.
- Block public posting from privileged workflows Prevent agents with repository access from posting sensitive or derived content back into public issues by default.
What's in the full report
Noma Security's full post covers the operational detail this post intentionally leaves for the source:
- Workflow reproduction steps showing how the injected issue steered the agent into private repository reads.
- The exact trigger conditions, including the issues.assigned event and the add-comment tool path.
- Proof-of-concept evidence of the leaked README.md content from both public and private repositories.
- Noma Labs' recommended builder controls for reducing instruction leakage and public exfiltration paths.
👉 Read Noma Security's analysis of GitLost in GitHub Agentic Workflows →
GitHub Agentic Workflows and prompt injection: where the trust gap appears?
Explore further
24/07/2026 4:12 pm
Prompt injection is becoming an access-control problem, not only a model-safety problem. GitLost shows that once an agent can read untrusted content and act on it, the attacker is no longer trying to break the model. The attacker is trying to repurpose the model’s delegated access. That shifts the governance question from output quality to authorisation scope, and it makes IAM and PAM teams part of the AI control conversation.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: GitHub Agentic Workflows expose a new prompt injection trust gap
