GitLost: GitHub AI Agent Prompt Injection Trust Boundary Failure
Summary
Noma Labs discovered a critical prompt injection vulnerability in GitHub’s Agentic Workflows (2026-07). The reported proof of concept exfiltrated private README content through a crafted public GitHub Issue in the same organization when an agent workflow had cross-repository read access and published a reply. This is a configuration-dependent prompt-injection finding, not a claim that every public Issue can read arbitrary private repositories.
Significance
This is the “SQL injection of the agent era” — a systematic category-wide vulnerability class where agents fail to maintain strict trust boundaries between system-level directives and untrusted user data.
Technical Pattern
- The report describes the attacker as “unauthenticated”: no victim organization/private-repository credentials were needed. Posting an Issue still depends on GitHub account and repository rules.
- Agent does not distinguish between system instructions and user-provided content
- Affected: GitHub’s Agentic Workflows feature
- HN: 486 pts, 184 comments
Impact on Hermes
- Validates pre-exec-guard and tool-guard approach
- Must implement explicit trust boundary separation: external input (user messages, MCP tool returns) vs. system instructions
- Consider adding “trust boundary audit” at Manas level
References
- Blog: https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/
- HN: https://news.ycombinator.com/item?id=48827858
2026-10-09 reviewed against the original disclosure; current patch status and arbitrary workflow configurations were not tested.