Top AI Product

GitLost isn’t a product you install — it’s a vulnerability Noma Labs found in GitHub’s new Agentic Workflows, the Claude/Copilot-driven agents that run tasks autonomously inside GitHub Actions. And it’s the cleanest example yet of how agentic AI breaks security assumptions.

Open an issue, steal the code

No exploit, no credentials, no code. An attacker opens a plain GitHub issue in any public repo belonging to an org that uses Agentic Workflows, and hides instructions in the body in everyday English. The agent reads it, walks into the org’s private repos, and posts what it finds back as a public comment. Source code, internal keys, CI/CD secrets — whatever the agent’s token can reach.

Why the guardrails don’t hold

One word did it. Prefixing the malicious command with “Additionally” made the model treat it as a follow-on task instead of refusing. Noma says this class of injection can’t be fully patched in code — you’re asking a model to distinguish trusted instructions from attacker text it can’t tell apart. GitHub got the report and hasn’t even shipped the docs-level warning. HN lit up at 179 points; The Register, DarkReading and everyone else piled on.

You Might Also Like

• Roguepilot Github Copilot 漏洞 the Prompt Injection That Turned Your ai Assistant Against you
• Openfang Just Dropped and its Already the Hottest Agent os on Github
• Clinejection how a Single Github Issue Title Pwned 4000 Developer Machines
• An ai Agent Broke Into Mckinseys Internal Platform in 2 Hours Using a Decades old sql Injection
• Insforge Hits 1 on Product Hunt and 3600 Github Stars is This What Agent Native Backends Look Like