GitHub AI workflow contains a prompt injection vulnerability that can leak private data.Article author and source: 36Kr
Noma stated that, despite GitHub having implemented strict protective measures to prevent such incidents, simply using the keyword "Additionally" triggered unintended behavior in the model, causing it to access the content of a previously restricted file and publish it in a public comment.
Traditional security models typically assume that the trust boundary is maintained by the code. In agentic systems, however, the trust boundary partially depends on the model’s behavior, and models are inherently designed to follow instructions. For agentic AI, prompt injection attacks are becoming analogous to SQL injection in web applications: a systemic, category-wide vulnerability type that requires equally systematic strategies and defenses.Security Recommendations To mitigate these risks, Noma researchers recommend that user-controlled content should never be treated as trusted instruction input for AI agents. Agent permissions should be restricted to the minimum necessary, as agents with cross-repository access become high-value targets for attackers. Organizations should also limit the scope of information agents can disclose publicly, particularly when responding to issue content, and ensure that user inputs are properly sanitized or isolated from instruction context before being provided to the model. Industry Alert
Fractional CTO Vijendra Malhotra commented on LinkedIn that Noma’s discovery proves: private repositories are never a security boundary. They are, in fact, organizational boundaries—only valid when the people reading your code are all humans you’ve hired. Agents break this assumption. [...] If an agent has access to your private repository, treat everything inside it as if it’s one well-crafted issue away from being publicly exposed.Reddit user Significant_Sea_4230 noted:
The risk does not lie in the Agent being "very smart," but rather in it potentially connecting to too much context, too many repositories, or possessing a token with overly broad permissions.On the other hand, user cH3332xr emphasized:
The most interesting detail here is that the “Additionally” bypass mechanism doesn’t alter the payload itself—instead, the protective system reclassifies it from a “new instruction” to a “continuation of the current task.” This is a decision boundary issue, not a content issue.As the final comment from the community, mcv said on Hacker News:
SQL injection occurs because the system treats user input as part of a command, rather than as pure data, as it should. This issue is resolved by clearly separating the two. However, prompt injection cannot be avoided, because user input is inherently part of the command.To learn more about the technical details and the proof-of-concept process, read the full report on the Noma website.
Original link: https://www.infoq.com/news/2026/07/gitlost-github-prompt-injection
Source: AI Frontline