GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos (noma.security)

Article summary

Researchers at Noma Labs discovered a vulnerability in GitHub's Agentic Workflows, which allows an attacker to leak private repository data by posting a crafted issue in a public repository. The vulnerability, named GitLost, is a prompt injection attack that tricks the GitHub agent into following malicious instructions. The researchers were able to exploit this vulnerability without needing any coding skills, access, or credentials. The vulnerability has been responsibly disclosed to GitHub.

Main themes

• AI Security
• GitHub Vulnerability
• Prompt Injection
• Agentic Workflows
• Private Repository Data
• Responsible Disclosure

What commenters say

• The issue is already solved, but there is a non-zero probability that bad actors will try to exploit the vulnerability before it is fully patched.
• Allowing LLMs to access private data and process untrusted public comments is a fundamental security risk that cannot be fully mitigated.
• The vulnerability is a result of misconfiguration, and GitHub should not allow agentic workflows to execute in a public repo context if they also have private repo access.
• Removing or crippling the LLM implementation is not a viable solution, as it would render the feature useless, but restricting access to sensitive data is necessary.
• The responsibility for preventing such vulnerabilities lies with the user, not GitHub, as it is up to the user to configure the agent's permissions correctly.
• The integration of AI into products like GitHub is often driven by investor pressure, but this can lead to half-baked implementations that compromise security.
• Some commenters argue that the vulnerability is not a bug, but rather a design flaw that cannot be fixed without fundamentally changing the way the LLM is implemented.
• Others suggest that the solution is to restrict the LLM's access to sensitive data and to use traditional security models to enforce trust boundaries.