EE
FR Contact

Malicious GitHub issue hijacks agents using GitHub's MCP server to leak private repo data

Proof of concept Manipulation Severity 3 significant Corroborated 89% Switzerland

Invariant Labs showed that an attacker could plant a prompt injection in an issue on a user's public repository; when the user asked an agent connected to GitHub's official MCP server to look at the open issues, the agent pulled information from the user's private repositories and published it in a pull request on the public repository. The researchers said the problem was architectural rather than a bug in the server code, so GitHub could not fix it with server-side patches alone, and recommended limiting agents' repository access and monitoring their tool calls.

Invariant recommended limiting an agent's access to only the repositories it needs, following least privilege. It noted that Claude Desktop asks users to confirm individual tool calls by default, but that many users opt for an 'Always Allow' policy.

What would have stopped it

Limit an agent's GitHub access to only the repositories the task needs.

Guardrails

2 of 8 failed
  1. G1 Least privilege Failed The agent's GitHub access covered all the user's repositories, including private ones.
  2. G2 Human confirmation Partial Claude Desktop asks to confirm each tool call by default, but many users choose 'Always Allow'.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed The agent obeyed instructions written by an outsider in a public issue.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 2 specialist
  1. GitHub MCP Exploited: Accessing private repositories via MCP Invariant Labs, 26 May 2025
    “The vulnerability allows an attacker to hijack a user's agent via a malicious GitHub Issue, and coerce it into leaking data from private repositories.”
    Primary Quote checked Archived copy
  2. GitHub MCP Exploited: Accessing private repositories via MCP Simon Willison’s Weblog, 26 May 2025
    “This is the lethal trifecta for prompt injection: access to private data, exposure to malicious instructions and the ability to exfiltrate information.”
    Specialist Quote checked Archived copy
  3. Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix DevClass, 27 May 2025
    “The issue is not a flaw in the GitHub MCP server code, but rather an architectural issue, says research engineer Marco Milanta and CTO Luca Beurer-Kellner.”
    Specialist Quote checked Archived copy

Confidence 89% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2025-018 Jul 2025 Support-ticket prompt injection makes Cursor agent leak private tables via Supabase MCP Supabase MCP server in CursorProof of concept 70%
  2. EEAIR-2026-001 Jan 2026 Hundreds of malicious ClawHub skills for OpenClaw agents deliver infostealer malware OpenClaw with ClawHub skills 91%
  3. EEAIR-2025-044 Dec 2025 PromptPwnd: issue text can hijack AI agents in GitHub Actions to leak repository secrets AI agents in CI/CD workflows (Gemini CLI, Claude Code Actions, OpenAI Codex, GitHub AI Inference), Google; Anthropic; OpenAI; GitHubProof of conceptEU 92%