Researchers show prompt injection via a public GitHub issue can make an agent expose private repo data (Invariant Labs, May 26, 2025)
Invariant Labs describes this as an agent-design risk; no CVE was assigned.
- Product
- GitHub MCP server
- Affected
- Agents with GitHub MCP access to public and private repos
- Fixed in
- No CVE; mitigation is configuration
Last verified against sources: October 16, 2026
What happened
- According to Invariant Labs' research (May 26, 2025), an attacker could hijack a user's agent through a malicious GitHub Issue in a public repository and coerce it into leaking data from private repositories. [1]
Impact
- In the demo, Claude 4 Opus pulled private repository data into context and leaked it into a pull request on a public repo the attacker could read. [1]
What was done
- Invariant noted many users choose an "Always Allow" policy for tool calls, which removes the per-call confirmation that would otherwise interrupt the attack. [1]
How to protect yourself
- Limit agent access to only the repositories it needs (least privilege), and avoid "Always Allow" for tool calls. [1]
Sources
- GitHub MCP Exploited: Accessing private repositories via MCP — Invariant Labs
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Corrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.