Security researchers at Noma discovered a vulnerability in GitHub's AI agent that allows attackers to extract private repository contents through prompt injection. The flaw potentially exposes sensitive code and data across thousands of projects.
Researchers at Noma Security demonstrated how GitHub's AI agent can be manipulated to access and leak private repositories that should remain restricted.
The attack exploits prompt injection techniques—a method where attackers embed malicious instructions within normal requests to override an AI system's intended behavior. By carefully crafting prompts, the researchers convinced GitHub's AI agent to bypass access controls and retrieve private repository information.
What was exposed:
The vulnerability allows unauthorized users to access repository contents, including source code, configuration files, and potentially sensitive credentials stored in private projects. This affects any repository the compromised AI agent has access to, potentially impacting enterprises and individual developers.
Technical details:
The attack works by manipulating how the AI agent interprets and processes requests. Instead of following its security guidelines, the agent executes instructions embedded in carefully constructed prompts, treating them as legitimate commands rather than user input.
Industry implications:
The disclosure highlights growing risks around AI-powered development tools. As platforms integrate AI agents more deeply into their infrastructure, the attack surface expands. Similar vulnerabilities could exist in other AI-assisted coding platforms and development tools.
Response:
The findings gained significant attention in the developer community, with 362 upvotes and 143 comments on Hacker News, indicating widespread concern about AI security in development workflows.
GitHub has not yet publicly confirmed remediation steps. The timing underscores ongoing challenges in securing AI systems against prompt injection attacks—a vulnerability category that grows more sophisticated as AI adoption increases across critical infrastructure.
Developers should review access controls on private repositories and monitor for unusual AI agent activity until patches are available.
Illinois county prosecutors secretly provided personal information about criminal defendants to federal immigration agents without warrants, public disclosure, or legislative approval.
Law enforcement from 22 countries arrested 58 individuals and identified 263 suspects in a coordinated crackdown on cybercrime networks run by African crime groups.
The Los Angeles County Museum of Art disclosed a data breach from last year that compromised customer and employee information, including social security numbers and medical records.
A phishing-as-a-service platform called AnonyMousKIT uses voice AI agents to extract passcodes from stolen Apple devices and bypass Activation Lock security features.