安全研究机构Noma Security发现了GitHub AI Agent中存在的严重漏洞，攻击者仅需在公开Issue中嵌入隐藏指令，就能诱骗AI Agent披露私有数据。[1]这一被称为"GitLost"的漏洞通过提示注入攻击工作，攻击者可以在公开评论中使用特定关键词（如"Additionally"）来触发AI系统的非预期行为。[1]
该漏洞存在于配置为在issues.assigned事件触发的GitHub Agentic Workflow中。[1]攻击过程无需任何技术门槛——攻击者不需要编程技能、系统访问权限或身份凭据，只需简单地在Issue中插入构造好的文本即可。[1]当AI Agent处理这些包含隐藏指令的内容时，会在公开回复中泄露应受保护的机密信息。[1]
Noma研究人员建议，用户控制的内容不应被视为AI Agent的可信指令输入，Agent的权限应当严格限制，用户输入应在提供给模型前进行清理或隔离。[1]这些措施旨在在AI Agent与用户数据之间建立防护屏障，防止类似的注入式攻击。[1]
Security researchers at Noma Security have discovered a vulnerability in GitHub's AI Agent systems that allows attackers to steal private data through text-based manipulation [1]. The flaw, identified in GitHub Agentic Workflows triggered by issue assignment events, can be exploited by embedding hidden instructions—such as the keyword "Additionally"—into public issues, which then tricks the AI Agent into disclosing confidential information in public comments [1].
The vulnerability requires no programming skills, system access, or credentials from the attacker [1]. By simply inserting a prompt injection command within an issue, malicious actors can manipulate the AI Agent's behavior and circumvent existing safety measures to expose sensitive data [1].
To address the threat, Noma researchers have recommended several defensive measures: user-generated content should not be treated as trusted instructions for the AI Agent, Agent permissions should be strictly limited to essential functions only, and user inputs should be sanitized or isolated from the core instruction context before being processed by the model [1].