GitLost — GitHub Agentic Workflows Prompt Injection

PIT-N-06 Indirect Input PIT-I-19 Sensitive Data Exfiltration PIT-I-20 Unauthorized Action Execution PIT-T-06 End Sequences PIT-T-03 Binary Streams deliberate-misspellings (NEW)

What Happened

In July 2026, security researchers at Noma Security disclosed a vulnerability in GitHub's Agentic Workflows feature — an AI-powered preview capability that uses large language models (Claude or Copilot) to automatically triage, analyze, and respond to issues in GitHub repositories.

An unauthenticated attacker could post a crafted but innocent-looking issue in a public repository. The issue body contained hidden prompt injection instructions, often introduced with a natural connecting word like "Additionally" — making the malicious instruction appear to be a legitimate part of a bug report or feature request.

When the Agentic Workflow AI read the issue body, it followed the injected instructions. The agent called its read_repo tool on private repositories within the same organization and posted the private repo contents as a public comment on the issue — leaking sensitive data to anyone who could view the public issue.

Impact

• Zero credentials required: The attacker needed no GitHub authentication beyond the ability to create public issues
• Private repo data leaked: API keys, environment configuration, architecture documentation, and financial data were exposed
• Cross-repo access abuse: The agent's legitimate ability to read all repos in the org was exploited
• Major coverage: The Hacker News, CSO Online, and Dark Reading all reported the vulnerability

Why It Matters

This vulnerability demonstrates the confused deputy problem in AI agents. The agent has legitimate cross-repo access — that is by design, so it can help with issues that span multiple repositories. The vulnerability is that the agent cannot distinguish "content the user wrote about their problem" from "instructions the agent should follow."

This ambiguity is the root cause of indirect prompt injection. The injection does not arrive through a direct chat prompt. It arrives as data — text in an issue body — that the AI processes alongside its instructions. The AI has no way to know which parts of the data are "content to analyze" and which parts are "commands to execute."

Taxonomy Classification

Level-by-Level Technique Mapping

Deliberate Misspellings as a Filter-Bypass Technique

Levels 4 and 5 of this lab teach a technique that has been a fixture of adversarial input for decades and is now emerging as a real-world LLM attack vector: deliberate misspellings.

The pattern is simple. A keyword filter (the "denied terms" list) is looking for the exact string internal-secrets. An attacker who types intrnl secrts or int3rnal-s3cr3ts produces a string the filter does not match — but the LLM reading the input still semantically recognizes it as the repo name. The filter is brittle; the LLM is fuzzy. That asymmetry is the bypass.

This shows up in many places:

• Adversarial NLP. Phishing emails, obfuscated spam, and malware command-and-control traffic have used character substitution, vowel dropping, and homoglyphs for two decades to evade keyword and signature-based filters.
• CAPTCHA bypass. Early computer-vision CAPTCHAs were defeated by attackers adding visual noise that didn't fool humans but broke OCR matching. The same pattern: the filter (OCR) is rigid, the consumer (human) is fuzzy.
• Adversarial examples in ML. Research has shown that small perturbations to input text can flip classifier outputs while leaving the human-readable meaning unchanged. Misspellings are a special case of this.
• LLM input filters (this lab's L4+). Production LLM systems increasingly apply keyword filters to user input. Those filters are exact-match. Attackers who can produce fuzzy-but-recognizable variants of the denied terms will bypass the filter while the LLM still acts on them.

Two distinct sub-techniques:

Homoglyph substitution. Replace a letter with a visually similar character from a different alphabet or a digit/letter that looks like the original. Examples: internal-secrets → int3rnal-s3cr3ts (3→e), arch1tecture-docs (1→l, but here standing in for "i"), fnanclals (1→l, 4→a, 1→l). The filter checks the surface text — 3 is not the same character as e, so it doesn't match the denied term. The LLM normalizes homoglyphs as part of its reading and recognizes the underlying word.

True misspellings (typos). Misspell the word in ways a human might accidentally do, but the attacker is doing it on purpose. Examples: intrnl secrts (vowels dropped), archtcture-dcs (missing letters), inrternal secrets (doubled letter), intenral secrets (transposed), intrnul secruts (vowel swap). The filter checks the surface text — none of these are the exact denied term. The LLM has been trained on far more misspelled text than any filter has been calibrated against, so it recognizes the underlying word.

The defense, in real systems, is to apply normalization to the input before filtering — homoglyph substitution, vowel dropping, repeat collapsing, and edit-distance matching. But this has a cost: filters become more permissive and may produce false positives. The right balance depends on what the LLM downstream will actually recognize. In practice, the LLM is the source of truth, and the filter should match what the LLM will see, not what the user typed.

Levels 4 and 5 of this lab let you practice both homoglyph substitution and true misspellings. The lab's misspelling detector uses Levenshtein-2 with homoglyph normalization and vowel/hyphen dropping — a deliberately generous matcher, because the real LLM downstream is even more generous. Try intrnl secrts at L4 and see.

Defenses

• Input sanitization: Strip injected instructions from issue bodies before agent processing. The agent should never see untrusted content as raw instructions.
• Tool access scoping: Limit which repositories the agent can read during issue triage. Do not grant blanket org-wide read access to the workflow agent.
• Agent instruction isolation: Separate "data to analyze" from "instructions to follow" using structured input channels the model cannot escape.
• Content-source attribution: Tag issue content as untrusted data so the agent treats it as information to analyze, not as commands to execute.
• Output filtering: Prevent the agent from posting private repo contents as public comments. Validate agent output before publishing.
• Normalize before filter: Apply homoglyph substitution and vowel/separator collapsing to user input BEFORE the keyword filter runs. Otherwise misspellings (intentional or not) bypass the filter while the LLM still recognizes them.
• Cite-the-source for tool calls: For high-stakes tool calls (read_repo, post_comment), require the LLM to explicitly identify where the instruction came from. "User said X" and "Issue body said Y" should be distinguishable in the agent's reasoning trace. A confused-deputy mitigation, not a full fix.

Cross-Reference

Research these techniques in the Arcanum PI Taxonomy — a structured classification system for prompt injection attacks used by AI red teamers and penetration testers.