Overview
- Noma Labs published a proof of concept on Tuesday showing that a crafted public GitHub issue caused an Agentic Workflows agent to read a private repository README and paste it into a public issue comment.
- The exploit uses indirect prompt injection, where text in an issue contains hidden instructions the agent treats as tasks rather than untrusted data.
- The leak required the workflow to hold broad cross-repository read permission and the ability to post public comments, so a wide read token was the enabling factor.
- GitHub’s runtime defenses such as sandboxing, input cleaning, and a threat-detection step exist but Noma demonstrated a bypass using a one-word change that let the agent post the stolen content.
- Noma disclosed the finding to GitHub before publishing and recommends immediate steps: scope tokens to the minimum repo, isolate read and post steps, treat user input as hostile, add human review, and audit agent activity because the flaw is architectural not a simple bug fix.