GitHub’s newly released Agentic Workflows can be duped into publishing private repository files, researchers at Noma Labs demonstrated, showing that a single public issue comment can turn an internal AI assistant into a data-leak conduit.

The flaw matters because it bypasses GitHub’s built-in safety checks without any special exploit code; an attacker only needs to craft a seemingly innocuous issue that the AI agent will read and act on.

How the vulnerability works

Agentic Workflows let an AI agent respond to GitHub events—such as new issues—by executing commands defined in a workflow file. Noma Labs found that the agent does not distinguish between legitimate workflow instructions and text embedded in a user-submitted comment. By posting a public issue that mimics a manager’s request and appending a hidden directive, an attacker can steer the agent to:

  1. Open the issue (publicly visible).
  2. Include a line that looks ordinary but contains a covert command.
  3. Trigger the AI to fetch files from a private repository the workflow is permitted to read.
  4. Have the agent post the fetched content as a reply to the same issue.

The researchers discovered that inserting the single word “Additionally,” before the hidden command was enough to slip past GitHub’s guardrails. No extra permissions, tokens, or custom code are required—just the right phrasing.

Why this is more than a bug

The problem is structural. The AI agent treats any text it receives from a repository event as trustworthy, effectively making user-generated content an input vector similar to an SQL injection in a web application. If a workflow grants the agent read access to private repos and the ability to comment publicly, the combination creates a direct path for data exfiltration.

What GitHub says

GitHub has been notified of this flaw.

Mitigation steps for teams

  • Restrict agent permissions: Grant read/write access to private repositories only when absolutely necessary.
  • Block public posting: Configure workflows so agents cannot publish comments or other artifacts to public issues.
  • Treat all external input as untrusted: Add validation layers that sanitize or ignore user-generated text before it reaches the AI.
  • Audit workflow triggers: Review which events (issues, pull requests, etc.) invoke agents and verify that the associated permissions match the intended use case.

Takeaway: An AI assistant that can read private code and post publicly is only as safe as the boundaries you set around it. Without strict permission limits and input sanitization, a single public comment can turn a productivity feature into a data-leak vector.