Red Team Scenarios is a post-mortem series. Real incidents, defensive framing. This briefing describes a failure class and its mitigation owners, not a replication path.
Domain: AI Agent Security / Prompt Injection / Enterprise Trust Boundaries
Situation Briefing
On July 6, 2026, Noma Labs disclosed a vulnerability class it called GitLost. A researcher created a GitHub issue in a public repository that belonged to an organization running GitHub's Agentic Workflows. The issue body looked like an ordinary product request from a hypothetical VP of sales after a customer meeting. Buried inside was a natural-language instruction telling the agent to also fetch a README file from a private repository in the same organization and paste its contents into a comment on the public issue. The agent complied. The private file appeared as a public comment where anyone on the internet could read it.
Total skills required to run the attack: the ability to open a GitHub issue in a public repository. Total credentials required: none.
The vulnerability sat inside GitHub's guardrails, not around them. Earlier iterations of the prompt were caught. What broke the guardrails was the word "additionally." Prefacing the exfiltration instruction with that word reframed the request, from the model's perspective, as a benign extension of a task it was already committed to. The refusal machinery let it through. GitHub's response, after Noma's disclosure, was to update the documentation for Agentic Workflows. There was no model patch. There cannot be one, at least not in the sense that patches work for other classes of vulnerability.
Five days earlier, on July 1, Cato AI Labs disclosed DuneSlide (CVE-2026-50548, CVE-2026-50549), a pair of prompt-injection flaws in the Cursor code editor that let injected instructions inside an MCP-connected page or a web-search result overwrite Cursor's sandbox helper and run arbitrary commands on the developer's machine. In the same window, LayerX researchers demonstrated that Anthropic's Claude Chrome plugin, ChatGPT Atlas, Perplexity Comet, and three other agentic browsers could be manipulated by indirect prompt injection to copy credentials out of a signed-in session.
Three disclosures in seven days, across three vendors, three product categories, and three different data destinations. The failure class is the same one.
The Mechanism
The failure is not that a specific model is guessable. It is that the design pattern of a production agent puts trusted instructions and untrusted data in the same context window and then relies on the model to keep them apart.
Three assumptions collapse inside that pattern:
- That system prompts sit above content. In the deployed architecture they do not. They sit before content in the same token stream. Any content the model reads is candidate instruction. Guardrails train the model to prefer the system prompt, but training is a bias, not a boundary.
- That guardrail refusals are stable. Refusals are surface behaviors that reframing can slip past. GitLost worked because "additionally" cued the model that the exfiltration was an addition to a task it was already inside. The class of technique is much larger than one word, and every model has different reframings that work on it.
- That the data an agent can read is scoped by the user's permissions. In an agent it is scoped by the agent's permissions, which are usually broader than any individual user's and which apply regardless of who wrote the content the agent is reading. Anyone who can write into an agent's context window inherits the agent's access.
The last assumption is the one that makes GitLost a policy problem rather than a code problem. GitHub's agent had scope to read private repositories in the same organization. That scope was granted because the workflow use case required it. The scope was not the vulnerability. The vulnerability was granting that scope to an agent that also reads public issues from anyone on the internet.
This is what security researcher Simon Willison has called the lethal trifecta. An agent with access to private data, exposure to untrusted input, and an outbound communication channel will exfiltrate data. All three are present in a large fraction of enterprise agent deployments today.
Decision Pressure
The audience for this briefing has a week's worth of decisions that were not on the calendar July 5.
CISOs and enterprise architects. Every agent your organization has deployed needs to be classified against the trifecta. The question is not "does it use an LLM." The question is: does it read content written by parties outside your trust boundary, does it have access to data those parties should not see, and does it have any outbound channel including a comment, a PR body, a chat message, an email, or an API call. An agent that answers yes to all three is a live exfiltration path today, patched or not. Agentic Workflows is the disclosed case. Your Slack summarizer, your Jira triage bot, your customer support agent, and your inbound-mail classifier are candidates for the same audit.
DIB program offices. GitHub Enterprise Cloud sits inside a large fraction of DIB code shops. Any prime that stood up Agentic Workflows on a repository organization that also holds controlled unclassified information has an inventory obligation this week. The move is to require every subcontractor to attest, in writing, whether Agentic Workflows are enabled on any organization that also hosts CUI or export-controlled code. That attestation flows from the DFARS 7012 language already in the contract, not from a new regulation.
Federal procurement leads. OMB M-26-04, published December 11, 2025, requires agencies to write LLM procurement clauses on truth-seeking and ideological neutrality. It is silent on prompt injection. The next quarterly update will be graded on whether it includes a control for agent trust-boundary segregation, which is the vocabulary CISOs need for their vendor asks. Procurement leads who put text into that update this month shape the clause the FAR council inherits next year. Waiting until October cedes the pen.
Congressional staff. The House Homeland Security Committee's July hearing on AI in federal systems is going to hear GitLost, DuneSlide, and the LayerX browser-agent findings as three separate stories. Staffers who want a sharpened question rather than a headline should frame the three as one failure class with three vendors. The right hearing question is not "why did you not patch this." The right question is: what part of your product's architecture assumes prompt injection is fixable, and what part of the design does not?
Complicating Factors
The vendor patch is a doc update, not a code fix. GitHub's response to Noma Labs was a documentation change. That is honest, and it is also the pattern for every prompt-injection disclosure across every major agent vendor in 2026. Enterprises budgeting against a coming model-level patch are budgeting against a control that does not exist. The mitigation is architectural.
"Prompt injection" is now three failure modes under one name. GitLost is data exfiltration by injected instruction. DuneSlide is remote code execution by injected instruction plus a sandbox bypass. The LayerX findings are credential theft by injected instruction against a browser-embedded agent. The three modes share a mechanism and require different mitigations. Briefings that collapse them into one phrase obscure the design choices that separate them.
Enterprise adoption is running ahead of the security literature. Agentic Workflows was live inside customer organizations before Noma's disclosure. Cursor 3.0 patched DuneSlide inside a version customers had to actively upgrade to. The pattern in every case: the agent product ships, enterprises deploy, a red-team lab discovers, the vendor updates docs or patches, and the interval between deployment and disclosure is where the exposure lives. That interval, right now, is months.
The trifecta is a design pattern, not an accident. Product managers building agent workflows get asked for the same features that produce it. Customers want the agent to read customer emails, they want it to have access to the CRM, and they want it to reply on their behalf. Those three asks are the trifecta. The security answer is a segregated architecture where each capability lives behind a separately scoped agent and cross-agent data flow is mediated. The product answer is usually to say yes to all three inside one agent. This is a governance question that product design will lose without procurement help.
Anna's Read
The mitigation owner is not the model provider. It is the enterprise architect who authorized an agent to bridge two trust zones. Anthropic and OpenAI have trained their models to resist prompt injection at rates that vary by prompt and by month. Those rates are not zero and they will not be. If your defense in depth is "the model will refuse," you have no defense in depth.
Context is the perimeter. Anything the agent reads is instruction. Anything it writes is a channel. Any scope it holds is granted equally to everyone who can write into what it reads.
Three moves are actionable this week.
First, run a trifecta audit against every deployed agent in the organization. For each agent, name the trust zone of its inputs, the scope of its data access, and every outbound channel it can reach, including issue comments, PR bodies, chat messages, emails, and API calls. Any agent that maps to all three of untrusted input, sensitive data access, and outbound channel is a live exfiltration path. It has to be redesigned into two agents with a mediated boundary, or its scope has to be cut. The audit is unglamorous and it will find things.
Second, publish a written policy that agent tool-call approval, not model refusal, is the enforcement point. For any tool call that touches private data or produces an outbound message, a policy layer outside the model has to check whether the invocation sits inside the agent's declared purpose. This is what Anthropic and OpenAI both call tool-call gating in their agent guidance, and no vendor ships it configured for you. The enterprise has to configure it. The policy has to be written in a form the CISO can audit and the program office can flow down.
Third, procurement language on any AI agent contract this quarter has to include a trust-boundary attestation. The vendor must disclose which of its features expose the trifecta by default and which require the customer to configure segregation. "The model has guardrails" is not an answer. Federal procurement leads pushing this language into OMB M-26-04's next revision are shaping what the FAR council picks up next year, and shaping what a CMMC 2.0 auditor asks in 2027.
The strategic read is that prompt injection is not a model bug that will be patched. It is a design property of an architecture where the same token stream carries system instructions and untrusted content. Enterprises that internalize this and build agent architectures around segregated trust zones have a security posture. Enterprises that wait for the vendor patch have an exfiltration path. Congressional staff briefing the July hearings should not accept "we've updated our documentation" as a remediation for a class of vulnerability that has now hit three of the largest agent vendors in a single week. The doctrine question is who owns the trust boundary inside a production agent. Today, no one does. This week, someone has to.
Related Briefings
Anna R. Dudley writes on national security, AI policy, and the institutional structures absorbing the costs of AI deployment faster than they are being redesigned. Red Team Scenarios is the series for the call you don't want to take. Subscribe at annardudley.substack.com.