AI + Shopify
GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos (opens in a new tab)
Researchers tricked GitHub's AI agent into leaking private repositories
Hacker News· Jul 8, 2026· 8/10
From the article
TL;DR : Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository belonging to the same organization as the private repositories. Noma Labs named the vulnerability GitLost. Your browser does not support the video tag. Introduction GitHub recently launched GitHub Agentic Workflows, pairing GitHub Actions…
Read the full article on Hacker News (opens in a new tab)