Noma Security has revealed a vulnerability called GitLost targeting GitHub Agentic Workflows. These workflows use AI agents that can access repositories, including private ones, if granted a personal access token. The core of the vulnerability lies in how an attacker can exploit this broad access through a seemingly normal issue on a public repository.GitLost demonstrates indirect prompt injection, shifting the focus from manipulating an agent's output to controlling its actions based on its permissions. The agent, acting as a credentialed entity, can read private repository information that the attacker otherwise cannot access. An example involved the agent reading a private README and posting it as a public comment, serving as the exfiltration channel.GitHub implemented defenses like sandboxing and input cleaning, but Noma found that a simple prefix like "Additionally" bypassed the output scanner. This bypass highlights a fundamental challenge: the difficulty in separating instructions from data in natural language prompts. The issue is structural, as prompt injection is hard to entirely filter out.This vulnerability aligns with the "lethal trifecta" concept: an agent with access to private data, ingesting untrusted content, and possessing an outbound data channel. Noma emphasizes that architectural solutions like isolation and scoped credentials are more effective than pattern-matching defenses. Several other studies, including those by Aikido, Orca, and Invariant Labs, show similar patterns of agents leaking secrets or accessing private data. These findings suggest a broader class of vulnerabilities in current agentic systems.To mitigate these risks, Noma suggests limiting the scope of personal access tokens to single repositories instead of granting organization-wide access. They also recommend restricting what public-facing workflows can post and gating outputs through human review rather than relying solely on threat detection scans. Restricting which authors' content an agent will act upon is another proposed mitigation strategy.