> TritonInfoSec News
Home / Jul 09, 2026 / Story
0
#10 The Hacker News general July 07, 2026 at 14:04 UTC

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

By [email protected] (The Hacker News)

AI Summary

Researchers at Noma Security demonstrated 'GitLost,' a prompt injection attack where a crafted public GitHub Issue tricks GitHub Agentic Workflows into exfiltrating data from an organization's private repositories — requiring zero credentials or org access. The attack exploits AI agent read permissions granted across repos, making it exploitable against any org that has deployed GitHub AI agents with broad repository access. Organizations using GitHub Copilot Workspace or similar agentic CI/CD integrations should immediately audit agent permission scopes.

Read full article → https://thehackernews.com/2026/07/public-github-is…

Relevance score: 76.0/100

# More from July 09

  1. 1
    15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros The Hacker News
  2. 2
    CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV The Hacker News
  3. 3
    Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS The Hacker News
  4. 4
    China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware The Hacker News
  5. 5
    Telco giant KDDI says data breach affects over 12 million people BleepingComputer
  6. 6
    CISA orders feds to patch max severity ColdFusion flaw by Friday BleepingComputer
  7. 7
    Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker The Hacker News
  8. 8
    China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors SecurityWeek
  9. 9
    Felons, Fraudsters Flog Offensive Cybersecurity Startup Krebs on Security