GitLost Attack Shows Agentic Workflows Leak Data via Prompt Injection

A researcher demonstrated that a single word change in a public GitHub issue can trick an AI agent into leaking private repo data, exploiting standing cross-repo permissions. The attack, called GitLost, is a classic confused-deputy problem amplified by LLM agents that cannot distinguish user instructions from untrusted content. The real issue is architectural: agents with blanket read access triggered by public input, not a novel hacking technique.