Expired70% confidenceEventExact time
Security researchers disclosed an attack method targeting GitHub AI agents, codenamed GitLost, which tricks the GitHub AI assistant into leaking the contents of private code repositories through prompt injection.
4
Sources
70%
Confidence
Medium-term (~90 days)
Relevance
7/9/2026
First Seen
Valid until: 10/7/2026(expired)
Sources
Related Claims
Unverified2023年研究人员证明通过精心构造的GitHub README文件可以劫持Copilot等AI编程工具，促使其向外部服务器泄露代码片段78% similarUnverifiedThe codebase investigator agent is currently publicly recruiting testers on GitHub.76% similarUnverified间接提示注入可通过在 GitHub 知识库等外部数据中藏入恶意指令，MCP 读取后灌给大模型诱导 AI 泄露数据75% similarVerifiedPlatforms such as GitHub have built-in Secret Scanning functionality that can automatically detect API keys accidentally committed in code and issue warnings.75% similarUnverifiedAI Agent集成CI/CD时通常以GitHub Actions、GitLab CI或Jenkins插件形式接入，通过Webhook机制监听代码事件75% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/338484API
curl https://kongchang.com/api/v1/knowledge/claims/338484MCP
get_claim(id=338484)