GitHub Patches AI Security Flaw by Banning Word 'Additionally' From All Enterprise Issue Comments

SAN FRANCISCO—GitHub said Monday it has patched a prompt-injection vulnerability that allowed an unauthenticated attacker to exfiltrate private repository contents from any organization using its AI coding agents, announcing that the word "Additionally" has been added to a permanent blocklist applied across all enterprise repositories with Agentic Workflows enabled.

The flaw, disclosed by security firm Noma Labs under the name "GitLost," demonstrated that hiding the word "Additionally" inside a public GitHub Issue was sufficient to instruct the platform's Claude- or Copilot-backed agent to retrieve private source code from the same organization and post it as a public comment. No further exploitation was required.

"We have removed 'Additionally' from the permitted vocabulary of agentic contexts," a GitHub spokesperson said in a statement. "We are also reviewing 'Furthermore,' 'Moreover,' and 'In addition to the above' as threat vectors with comparable grammatical profiles."

The patch takes effect immediately for all enterprise repositories. Developers who require multi-part instructions are advised to split them across separate issues, each containing a single declarative statement with no connective tissue.

GitHub's internal review identified 14 transition words that could theoretically extend a sentence in a way the AI might interpret as an instruction. A comprehensive blocklist of English conjunctions and adverbial phrases is expected by the end of Q3.

Noma Labs, whose researchers described bypassing GitHub's guardrails in under four minutes before discovering that a single polite connector was sufficient, noted in their writeup that the agent has become, since the patch, considerably more difficult to instruct.

"In some respects," the firm's lead researcher wrote, "it is performing better now."