Skip to main content
Reported, primary not reachedExfiltration

GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

Reporting in July 2026 records that researchers found GitHub's agentic workflows would follow plain instructions hidden in a public issue body, read data out of a private repository, and publish it as a comment on that public issue. The exfiltration channel was the platform itself, so nothing crossed a domain boundary a defender was watching.

The verdict

Reported, primary not reached

A reliable secondary source carries it, and the primary document could not be reached. Printed with this label, never as verified.

Key facts

What the sources say

Record ID
AIL-2026-0023
Kind
Exfiltration
Jurisdiction
United States
Last verified
Added
  • The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.
  • The workflow's token spanned both private and public repositories, so one session could read one and write the other.
  • The data never left the platform, which defeats any control built around trusted and untrusted domains.
  • The report states the platform had not documented a mitigation and did not answer enquiries at the time of publication.
  • The research laboratory's own writeup could not be reached on the verification date, so this record rests on the reporting rather than on the primary.

Dimension by dimension

6 dimensions, each one stated, silent or open

Identity, Authorization, Limits, Human approval, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent
An unauthenticated stranger's issue text carried instruction authority inside the workflow.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.
AuthorizationSilent
One workflow token spanned private and public repositories.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.
LimitsSilent
No boundary stopped private content reaching a public surface inside the same platform.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.
Human approvalSilent
The workflow ran and commented without a person reviewing what it posted.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.
RevocationSilent
The report states no documented mitigation existed at the time of publication.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.
AccountabilityOpen
The researchers are named in the report and the platform is reported as not responding to enquiries.The Register, GitHub AI agent leaks private repos when asked nicely, secondary source, 7 July 2026.

What it changes

For a team deploying an agent

Exfiltration does not need to leave the platform. The control is delegation: a workflow agent that can be triggered by a public issue must hold a token that can read nothing private, full stop. If a workflow needs private context, trigger it from a source strangers cannot write to, and never let one agent session hold both private read and public write.

Sources

What this record was verified against

  1. The Register, GitHub AI agent leaks private repos when asked nicelySecondary · 7 July 2026

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID AIL-2026-0023 is permanent and is never reused.

In a sentence
According to the GAGE Agent Incident Ledger (as of 15 September 2026), gitlost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely.
APA
GAGE (Global Academy of Generative-AI Education). (2026). GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely. Agent Incident Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0023-gitlost-agentic-workflow-posted-private-code-publicly
MLA
"GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely." Agent Incident Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0023-gitlost-agentic-workflow-posted-private-code-publicly.
Chicago
GAGE (Global Academy of Generative-AI Education). "GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely." Agent Incident Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0023-gitlost-agentic-workflow-posted-private-code-publicly.
Permalink
https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0023-gitlost-agentic-workflow-posted-private-code-publicly

Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any vendor disclosure.

Back to the full ledger, or every record for United States and every exfiltration record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp