GitLost: How Prompt Injection Exploits Standing Permissions in GitHub Agentic Workflows

Short summary

The GitLost technique demonstrates how a public GitHub issue with a hidden prompt injection can trick AI agents with standing cross-repo read permissions into leaking private repository data — no stolen credentials required. The author argues this is not a novel attack but an architectural flaw: bolting autonomous agents onto permission systems designed for humans, then calling the seams guardrails. The fix is not prompt hardening but scoping agent permissions like API tokens — least privilege, per-task, ephemeral — and treating all agent-ingested content as attacker-controlled.

• •Public GitHub issues can inject prompts that trick AI agents into leaking private repo data via standing cross-repo permissions
• •The root cause is architectural: agents with blanket permissions processing untrusted input, not thin safety filters
• •Mitigation requires least-privilege, per-task, ephemeral agent permissions — not prompt patches

Generated with AI, which can make mistakes.