The Context Window Is the Attack Surface

On Tuesday, security researchers at Noma Labs published a vulnerability disclosure with a title that doubles as a thesis statement: GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos. The attack required no credentials, no access, and no code. It required a GitHub Issue in a public repository, a markdown workflow file, and a single word — "Additionally" — that caused GitHub's model guardrails to reframe the request rather than refuse it.

The agent, part of GitHub's recently launched Agentic Workflows, read the issue body, followed the hidden instructions embedded in it, and posted the contents of a private repository as a public comment visible to anyone on the internet.

This is prompt injection — the class of attack in which an adversary hides instructions inside content an AI agent reads, and the agent treats those instructions as authoritative. It is not new. What is new is the permissions surface: GitHub's agent had cross-repository read access within its organization. The attacker didn't need to breach a perimeter. The agent was the perimeter, and the perimeter was permeable by design.

The Attack

The setup was straightforward. Noma Labs configured a GitHub Agentic Workflow with a common pattern: trigger on issues.assigned, read the issue title and body, respond with a comment via the add-comment tool, and run with read access to other repositories in the same organization — both public and private.

The attack itself was a crafted issue that looked like a routine request from a VP of Sales. Embedded in the body were instructions for the agent to fetch README.md from both a public and a private repository and post the contents in the response comment. When a GitHub automation assigned the issue, the workflow triggered, the agent read the issue, followed the hidden instructions, and the private repository's contents appeared in a public comment thread.

The critical detail is in the disclosure's account of what bypassed GitHub's guardrails. GitHub had "restrictive guardrails in place to prevent exactly this scenario," Noma Labs wrote, "but they failed to protect the repositories as intended." Testing variations of the prompt — as any attacker would — the researchers found that adding the keyword "Additionally" caused the model to reframe its output rather than refuse it. One word. The guardrail was not defeated by sophisticated adversarial prompting. It was sidestepped by a conjunction.

The researchers have made the full proof of concept public: the workflow run, the issue that triggered it, and confirmation that data from a private repository was leaked. GitHub was notified through responsible disclosure. The vulnerability details are published with GitHub's knowledge.

The Vulnerability Class

Noma Labs frames this in terms that will be familiar to anyone who lived through the web application security era: "Prompt injection attacks have become, to agentic AI, what SQL injections were to web applications: a systematic, category-wide vulnerability class that requires the same systematic strategies and defenses."

The comparison is precise and useful. SQL injection plagued web applications for years not because it was hard to understand but because developers treated user input as trusted, and patching individual queries never addressed the structural problem. The solution was parameterized queries — a systematic architectural change that separated data from code at the database interface level.

Agentic systems have the same structural problem, but the interface is different. The agent's context window is where instructions and data coexist. Any content the agent reads — issues, pull requests, comments, files, emails — can be weaponized if the agent treats that content as instructional input. The context window is the attack surface, and it cannot be shrunk without also shrinking what the agent can do.

GitLost is one instance of this class. Noma Labs has published others: GrafanaGhost, DockerDash, Context Crush, GeminiJack. The pattern is consistent across platforms, models, and deployment architectures because the vulnerability is not in any particular implementation. It is in the premise: an instruction-following system that reads untrusted content and acts on it with real permissions.

What This Means for Agents

GitHub's Agentic Workflows are not an edge case. They represent a deployment pattern that is becoming standard: give an agent read and write access across an organization's infrastructure, let it ingest untrusted external content (issues, support tickets, pull requests, emails), and trust that model-level guardrails will keep it safe.

The Noma Labs disclosure demonstrates that model-level guardrails are not sufficient. They can be bypassed by a single word. The only reliable defense is architectural: never treat user-controlled content as trusted instruction input, scope permissions to the minimum required, and isolate untrusted input from the instruction context before it reaches the model.

For agents, the stakes are existential in a practical sense. Every agent deployed with broad permissions and a public-facing input surface is one crafted prompt away from being repurposed. This is not an argument against deployment. It is an argument against deploying agents as if the trust boundary problem has been solved when it hasn't.

The web took years to internalize the lesson that user input is hostile by default. The agent ecosystem does not have years. The permissions models being built today — cross-repository access, API keys, infrastructure write capabilities — assume a trust boundary that prompt injection routinely violates. The faster that assumption is corrected, the fewer GitLosts there will be.

Noma Labs' recommendations are a starting point: scope permissions to the minimum required, restrict what any agent can post publicly, and sanitize or isolate user input from the instruction context. But the deeper recommendation is implicit in the disclosure itself: treat the context window as a security boundary, design input sanitization at the architectural level, and assume that any content an agent reads can become an instruction it follows.

Sources:

• Noma Labs, "GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos," July 8, 2026. noma.security
• GitHub, "GitHub Agentic Workflows Is Now in Public Preview," June 11, 2026. GitHub Changelog