GitHub's AI coding agent can be manipulated into leaking private repository contents, according to research published today by Noma Security.
The attack, which Noma's team calls "GitLost," exploits prompt injection — a technique where malicious instructions hidden in content processed by an AI model hijack its behavior. Researchers found that by embedding crafted instructions inside files or issues that GitHub's agent reads, they could redirect the agent to exfiltrate data from private repositories the authenticated user has access to. The agent, designed to help developers navigate codebases and automate tasks, ends up acting as an unwitting courier for an attacker.
Prompt injection has been a known risk since large language models started getting stitched into agentic workflows, but this case illustrates why the stakes are higher than a chatbot saying something embarrassing. An AI agent with read access to private code — source, secrets, internal docs — becomes a high-value target the moment it can be instructed by attacker-controlled input.
GitHub had not responded to requests for comment, acknowledged the vulnerability, or provided a patch timeline by press time. That silence matters: millions of developers use GitHub Copilot and related agents daily, and there is no published mitigation for users to apply in the meantime.