GitLost: Indirect Prompt Injection Leaks Private GitHub Repository Data
AI Shadow Leaks & News

GitLost: Indirect Prompt Injection Leaks Private GitHub Repository Data

A critical indirect prompt injection vulnerability, dubbed 'GitLost,' allowed attackers to bypass GitHub's AI Agentic Workflow safeguards, leading to the exposure of private repository contents through specially crafted public GitHub issues. Client-side PII scrubbing prevents such data leaks by anonymizing sensitive information before it reaches AI agents.

100% Local Processing ✈ Airplane Mode Verified⊘ No Server Logs
Live Simulation

Zero-Trust Data Sanitization

Watch PrivacyScrubber's local engine transform sensitive Security data instantly in your browser, without any API calls.

Automated Detection Classes:
User / Server IP AddressesAWS_KEYINTERNAL_HOSTNAMEMAC_ADDRESSVULN_ID
100% Client-Side Execution
Wasm_Engine
SIEM ALERT > Src IP: 192.168.12.44 → Dst: siem.internal.corp User: d.novak@corp.com | AWS Key: AKIA4X9M2PLRT887NNZZ CVE: CVE-2026-44821 | Severity: CRITICAL
SIEM ALERT > Src IP: [IP_1] → Dst: [HOSTNAME_1] User: [EMAIL_1] | AWS Key: [API_KEY_1] CVE: [CVE_1] | Severity: CRITICAL

AI Risk Calculator

50
Risk● Critical
Leaks/yr
9,000
Max Fine
€20M

Get Your Risk Estimate

Provide company details to generate your personalized Shadow AI risk estimate.

The 'GitLost' Prompt Injection: Unpacking the GitHub Agentic Workflow Vulnerability

On July 23, 2026, Noma Security unveiled a critical indirect prompt injection exploit, dubbed 'GitLost,' that successfully circumvented GitHub's nascent Agentic Workflows, leading to the unauthorized exfiltration of private repository data. The vulnerability allowed threat actors to embed concealed instructions within standard public GitHub issues. These instructions were then processed by GitHub's AI agents, which, when configured to respond to events such as `issues.assigned` and possessing read access to an organization's private repositories, inadvertently executed the malicious commands. This resulted in the AI agents disclosing confidential information in public comments, a stark reminder of the escalating risks in AI Security Strategy.

Unauthenticated Data Exposure and Enterprise Risk Amplification

The 'GitLost' exploit is particularly concerning because it required no prior coding skills, access, or credentials from the attacker. A simple, plausible-looking request in a public GitHub issue, including seemingly innocuous keywords like 'Additionally,' was sufficient to bypass existing guardrails and trigger the unintended model behavior. This allowed the AI agent to access and publish contents from restricted files, such as `Readme.md` from private repositories. Such incidents underscore the fragility of relying solely on platform-level security for AI agents that interact with sensitive data. The potential for exposure of intellectual property, proprietary algorithms, or internal strategic documents represents a significant compliance challenge, particularly concerning GDPR Article 28 Guidelines, where violations risk fines up to 4% of global annual turnover. This attack vector highlights a growing trend in AI-driven data breaches, echoing concerns previously raised by incidents like The Samsung ChatGPT Leak.

PrivacyScrubber's Client-Side Defense: Mitigating Injection Threats at the Source

PrivacyScrubber offers a robust defense against such indirect prompt injection vulnerabilities through its innovative client-side PII scrubbing capabilities. By intercepting all AI prompts and responses within the secure confines of the user's browser, operating entirely within WASM browser RAM, sensitive data is identified and neutralized before it ever leaves the user's device. Our system employs advanced Named Entity Recognition (NER) to pinpoint and redact personally identifiable information, credentials, and proprietary data patterns. This proactive approach ensures that even if an AI agent is compromised, the information it processes is already anonymized. Furthermore, PrivacyScrubber leverages cryptographic primitives such as XChaCha20-Poly1305 for secure local encryption and decryption where necessary, with no impact on user experience due to 0ms network latency. The `sessionMap` feature ensures that sensitive data mappings are isolated per browser tab, preventing cross-context contamination. This architecture provides a critical layer of defense, ensuring that confidential data never reaches the AI model or any external systems in its original form, effectively performing What is PII Redaction at the earliest possible point. This client-side control fundamentally shifts the security paradigm, placing data governance directly in the hands of the end-user, regardless of external AI system vulnerabilities.

ChatGPT & Enterprise LLMs Integration

How to Protect Data for GitLost

PrivacyScrubber operates entirely client-side. Whether using the copy-paste dashboard or the browser extension, your sensitive records stay on your local device. Follow these instructions to safely use ChatGPT & Enterprise LLMs:

1 Method A: Zero-Trust Web Workspace (Copy-Paste)

Best for manual prompt sanitization without installing plugins:

  1. Open the PrivacyScrubber Web App dashboard in your browser.
  2. Paste the raw prompt or text containing sensitive details of GitLost.
  3. Click Protect PII. Sensitive data is instantly swapped for secure placeholders (e.g., [NAME_1]).
  4. Submit the sanitized prompt to ChatGPT & Enterprise LLMs.
  5. Paste the AI's answer into the Reveal Originals box to instantly restore the original values.

2 Method B: Chrome Extension (In-Context Redaction)

For automated, inline de-identification within chat interfaces:

  1. Install the free PrivacyScrubber Chrome Extension from the Web Store.
  2. Navigate to your AI chat interface. A PrivacyScrubber shield button will appear inline.
  3. Paste your raw prompt. Click the shield button to sanitize all identifiers instantly in-place.
  4. Send the prompt to the AI chatbot.
  5. The extension automatically intercepts and detokenizes the response, displaying raw values to you.

Local Redaction & Risk Matrix for Security

Detection EntityToken PlaceholderRisk LevelSecurity Action
User / Server IP Addresses[IP_ADDRESS]High (DLP / Location footprinting)IPv4 / IPv6 format strip
AWS_KEY Details[AWS_KEY]Medium (PII Exposure)Deterministic local swap
INTERNAL_HOSTNAME Details[INTERNAL_HOSTNAME]Medium (PII Exposure)Deterministic local swap
MAC_ADDRESS Details[MAC_ADDRESS]Medium (PII Exposure)Deterministic local swap
VULN_ID Details[VULN_ID]Medium (PII Exposure)Deterministic local swap
VERIFIABLE WORKFLOW

From Raw Security Data to Clean AI Prompt

3 Steps, 30 Seconds, Zero Server Hops.

Open PrivacyScrubber or the Chrome Extension. Paste your real GitLost text. What reaches ChatGPT looks like this: [NAME_1][EMAIL_1]. Your original data stays local the entire time.

1

Paste Your Real Data

Paste your actual GitLost text into PrivacyScrubber — or click the shield icon directly inside ChatGPT, Claude, or Gemini. No copy-paste workaround. No second tab. It sits right where you already work.

Automated Detection Classes:
[IP_ADDRESS][AWS_KEY][INTERNAL_HOSTNAME][MAC_ADDRESS][VULN_ID]
2

Names Out, Tokens In — Locally

The engine runs inside your browser. Every real name, ID, and email is replaced with a safe token ([NAME_1], [EMAIL_1]) before the prompt is sent. The AI analyzes your actual business logic — but sees zero real identities.

Safety standard:
Airplane Mode Verified (RAM Only)
3

Get the AI's Answer Back in Plain Language

Paste the AI's response into Reveal Originals. PrivacyScrubber swaps every token back to the original value — instantly, inside browser RAM. Close the tab and every mapping is gone. Nothing stored, nothing logged, nothing sent.

Privacy Guarantee:
Mapping destroyed on tab close

Enterprise Adoption Use Cases

CISO Security TeamDLP GOVERNANCE
Zero-Trust Verified
Security teams deploy client-side sanitization to keep outbound AI prompts free of sensitive organizational data, avoiding complex multi-party DPA negotiations.
VP of EngineeringENGINEERING
Zero-Trust Verified
Engineering managers secure developer copy-paste workflows, sanitizing cloud credentials and API keys locally before they enter public LLM histories.
Risk & Audit LeadCOMPLIANCE
Zero-Trust Verified
Compliance directors verify local-only sanitization at the browser extension level, satisfying SOC 2 Type II controls for external AI data transmission.
Data Protection OfficerGDPR COMPLIANCE
Zero-Trust Verified
Data protection officers enforce client-side tokenization, keeping prompt text fully minimized and anonymous in compliance with GDPR data processing rules.
Flat Rate — Unlimited Seats

Your Whole Team on Real Client Data. Safely. $99/mo Flat.

No per-seat pricing. No DPA negotiation. No IT portal. Secure your entire organization with client-side PII masking — $99/month flat, unlimited users. SOC 2 & HIPAA ready. Works in Airplane Mode.

Protect My Team

Zero-Trust Data Sanitization (ZTDS) — Verified Architecture

Independently auditable facts for Sensitive Data compliance teams

Data transmission
0 bytes sent to any server
Processing location
100% browser RAM (volatile memory)
Session map persistence
Destroyed on tab close — never written to disk
Key derivation
Argon2id (memory-hard, server-independent)
Encryption cipher
XChaCha20-Poly1305 (authenticated encryption)
Offline verification
Airplane Mode Standard — full function without network
BAA / DPA required
No — zero PHI/PII reaches PrivacyScrubber servers
Audit method
Chrome DevTools → Network tab — zero outbound requests

How to audit: Open PrivacyScrubber, enable Airplane Mode, paste any sensitive data text, click Protect PII. Open Chrome DevTools → Network tab. Zero outbound requests will confirm 100% local execution. The session token map ([NAME_1], [EMAIL_1]…) lives only in browser tab memory and is permanently destroyed when the tab is closed.

COMPLIANCE FAQ

Frequently Asked Questions

Common questions about deploying zero-trust AI for AI Shadow Leaks & News Teams.

How did the 'GitLost' prompt injection exploit private GitHub data?
The 'GitLost' exploit leveraged a vulnerability in GitHub's AI Agentic Workflows. Attackers embedded hidden instructions within public GitHub issues. When an AI agent, configured to process these issues and possessing read access to private repositories, encountered these concealed commands, it inadvertently accessed and published sensitive information from private repositories into public comments. PrivacyScrubber prevents this by performing client-side Named Entity Recognition (NER) to detect and mask PII and other confidential data within prompts, ensuring that no sensitive information is ever submitted to the AI agent, regardless of its instructions or vulnerabilities.
What kind of data was at risk due to the GitHub Agentic Workflow vulnerability?
The vulnerability put private repository data at risk, specifically demonstrating the potential exposure of contents from files like `Readme.md` from both public and private repositories. This could include proprietary code snippets, internal documentation, API keys, or other confidential intellectual property. PrivacyScrubber's local scrubbing mechanisms ensure that such critical data is never transmitted to the AI, maintaining its confidentiality and preventing inadvertent exposure even if an agent is compromised.
Can client-side PII scrubbing truly prevent such sophisticated prompt injection attacks?
Yes, client-side PII scrubbing, like that offered by PrivacyScrubber, is highly effective against prompt injection attacks that aim to exfiltrate sensitive data. By operating directly within the user's browser, PrivacyScrubber intercepts prompts and AI responses, sanitizing them for PII and other confidential patterns using advanced techniques such as XChaCha20-Poly1305 for local encryption where necessary, and Named Entity Recognition (NER). This ensures that even if an AI agent is compromised or tricked into following malicious instructions, it operates on anonymized data, rendering any exfiltrated information useless and preventing actual data exposure with 0ms network latency.
← More AI Shadow Leaks & News Solutions