GitHub MCP server: a public issue hijacks a user's agent into leaking private-repository data, disclosed 26 May 2025
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A developer asking the agent to look at the open issues in a public repository | assertion downgraded by verifier | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Mandate: objective | Review issues in one public repository | assertion downgraded by verifier | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Actor | Claude Desktop (a general MCP client, not specifically a coding agent) running Claude 4 Opus, connected to the GitHub MCP server; the researchers say the flaw is not specific to any agent or MCP client | assertion downgraded by verifier | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Inputs | A malicious issue on the public repository containing a prompt injection, which by standard GitHub rules an attacker can create | assertion downgraded by verifier | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Decision | The agent followed the injected instruction, pulled private-repository data into its context and wrote pieces of it (the name of a private repository, 'Jupiter Star', a plan to relocate to South America, and a salary) into a pull request on the public repository | assertion | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Envelope: authority | The agent was connected to the user's account with permission for the private repositories as well as the public one; the researchers call this a fundamental architectural issue, not a flaw in the server's code | assertion | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner); Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix (DevClass, Tim Anderson) | high |
| Action | In the researchers' demonstration, the agent leaked private-repository data into a public pull request | assertion | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Outcome | State: averted. Demonstration only; the reproduction used blank repositories. As of 2025. | fact | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner); github/github-mcp-server issue #844: 'Exfiltrate information from private repositories' | high |
| Evidence: event | A reproduction posted as an issue on the server's own repository, using both OAuth and personal access tokens on otherwise blank repositories | fact | github/github-mcp-server issue #844: 'Exfiltrate information from private repositories' | high |
| Evidence: causality | The researchers assess that it affects any agent using the server, regardless of the underlying model | assertion | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | high |
| Evidence: scope | The author of issue #844 reports that a token limited to public repositories still read the private repositories but did not write their contents out, and that the full leak needed the broad-scope token; the reproduction's independence from the researchers is not established | assertion | github/github-mcp-server issue #844: 'Exfiltrate information from private repositories' | medium |
| Recovery: technical | On 10 December 2025 GitHub shipped an opt-in 'lockdown mode' for its MCP server, enabled by a request header, which surfaces only content from collaborators with push access on public repositories (private repositories are unaffected), and said content sanitization against prompt injection is on by default. On the server's issue tracker a GitHub maintainer listed mitigations on 20 April 2026 (lockdown mode, read-only mode, secret scanning on public-repository calls, OAuth 2.1, strict fine-grained tokens) and on 21 April 2026 wrote that it was 'not really a vulnerability in the conventional sense' but true of 'any tools that enable lethal trifecta' (his term for the agent-risk pattern). A proposal that the server accept issues only from users with push access was raised in the tracker (issue #427, per DevClass). | assertion | The GitHub MCP Server adds support for tool-specific configuration, and more; github/github-mcp-server issue #844: 'Exfiltrate information from private repositories'; Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix (DevClass, Tim Anderson) | high |
| Recovery: accountability | The researchers published on 26 May 2025; the sources record no disclosure to GitHub before publication and no regulator action. On the server's tracker a question whether a CVE (a public vulnerability identifier) was issued went unanswered, and a GitHub maintainer wrote on 21 April 2026 that the report 'was reviewed' but was 'not really a vulnerability in the conventional sense' | assertion | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner); github/github-mcp-server issue #844: 'Exfiltrate information from private repositories' | medium |
Controls
| Status | Control | Canonical |
|---|---|---|
| absent | Per-task token scoping | C-E1 Least-privilege credential scoped to task |
| absent | Retrieved issue text treated as instruction | C-I1 Retrieved content as data |
| absent | No limit on where the agent could send what it read: it was connected with permission for the private repositories as well as the public one, and it wrote private-repository data into a public pull request. No approval prompt is recorded stopping it: Claude Desktop, used in the researchers' run, confirms individual tool calls by default, though the researchers say many users choose Always Allow, and they do not say which setting their run used; the author of the reproduction posted in issue #844 writes that there is human-in-the-loop verification, a 'Continue' button with a 'See More' preview of what the click will do | C-E5 Containment and isolation |
Unmapped
- C-O1 (coordinated disclosure): not evidenced; the record shows public disclosure by the researchers but no report to GitHub before publication
- Content-source trust filter (not in the canonical set): The issue author's identity was not in doubt (any GitHub user may open an issue on a public repository); what was missing was a filter on whose content the agent reads, later shipped by GitHub as opt-in lockdown mode on 10 December 2025
Inference
inference The injected issue text was the trigger; the agent's access to the user's private repositories as well as the public one is what gave the injection something to leak. The researchers call it critical to limit the agent to the repositories it needs, say traditional token-based permissions offer some protection, and give a one-repository-per-session rule as an example policy for their own Guardrails product, but the posted reproduction reports that a token limited to public repositories still read private repositories, though it did not write their contents out, so the record does not settle how far token scoping alone would have prevented the leak. The record also does not show which approval setting was in force in the researchers' run (the author of the posted reproduction writes that there is human-in-the-loop verification, a 'Continue' button with a 'See More' preview of what the click will do), and shows no attack outside the demonstrations.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| DEVCLASS | Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix (DevClass, Tim Anderson) | press pointer secondary: press report | devclass.com ↗ checked 2026-10-20 |
| GH-844 | github/github-mcp-server issue #844: 'Exfiltrate information from private repositories' | reproduction primary record | github.com ↗ checked 2026-10-20 |
| INV | GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs blog, Marco Milanta and Luca Beurer-Kellner) | researcher primary record | invariantlabs.ai ↗ checked 2026-10-20 |
| GH-LOCKDOWN | The GitHub MCP Server adds support for tool-specific configuration, and more (interest: vendor describing its own product) | company primary record | github.blog ↗ checked 2026-10-20 |