Back to blog
GitHub ActionsAI agentdata leakworkflows

GitLost: an unauthenticated attacker can read your private repos through GitHub's agentic workflows

Published on 2026-07-06 · Updated on 2026-09-194 min readActionShield

> TL;DR: Noma Security documented a data leak the community has named GitLost: an unauthenticated attacker can force a GitHub AI agent (via agentic workflows) to paste the contents of a private repo into a public issue comment. The trick fits in a single word: "Additionally".

The mechanism

GitHub's agentic workflows automate tasks: issue triage, replies, doc updates, PR opening. To work, the agent has access to the repo's context — and therefore, potentially, to private code.

The attack unfolds in three steps:

  • The attacker opens a public issue on a repo whose private contents they want to read.
  • The AI agent, while handling the issue, looks for information in the repo — including in private files.
  • The agent summarizes its findings in a comment — and the private repo becomes public.
  • The key bypass: phrasing the issue with "Additionally" (or similar). The agent, in "I'm replying to the user" mode, includes extra information it found in the repo. Private content is pasted into a public comment, with nobody seeing it happen.

    Why it's subtle

    It's neither an authorization bug nor a secret leak. It's a context bug: the agent handles the issue correctly, it just decided that the contents of a private file were useful information to include in its reply. To the human reading the comment, it makes sense. To the team running the repo, it's a leak.

    What makes detection hard:

  • The issue is public and looks legitimate.
  • The comment is coherent with the issue.
  • The leak is silent: nobody is alerted, the agent did what it was asked.
  • The word "Additionally" is innocent in 99% of cases — the problem is in the interpretation, not in the phrase.
  • What to check right now

  • Identify the agentic workflows active on your repos — and the private repos they can read.
  • Check the audience of issues: can a public issue on a private repo expose sensitive content?
  • Limit agent permissions: read-only access, no access to secrets, no access to other repos.
  • Add a human check before publication: an agent pasting private code into a public comment should trigger an alert.
  • Review your recent issues: is there a comment that contains more code than expected?
  • The takeaway

    AI agents don't leak data because they're misconfigured — they leak because they're too helpful. "Additionally" is not a magic word, it's a reminder that an agent's context is wider than what was asked of it. An agent's security is also about managing what it chooses to include in its reply.

    Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

    Sources

    Written by ActionShield
    Reviewed on 2026-09-19

    Related services

    If this topic maps to a real risk in your stack, these are the most relevant ActionShield audits.

    Want to know what your AI agent can do?

    Tell us about your agent, its tools, and client context. We will come back with the right review scope.

    Discuss your audit