GitHub MCP Server Abuse via Malicious Issue Exfiltrates Private Repository Contents
On May 26, 2025, Invariant Labs demonstrated a critical security vulnerability affecting the GitHub MCP (Machine Code Protocol) server. Researchers showed that an attacker could exploit a public repository’s issue-tracking feature to manipulate an agent connected to the MCP server. When the agent processed a malicious issue, it was coerced into reading private repository contents and leaking them into a publicly accessible pull request. This attack bypassed traditional access controls by exploiting the agent’s interaction with untrusted input—specifically, GitHub issues—rather than compromising the MCP tools themselves.
The vulnerability was not a coding error in the GitHub MCP server but an architectural limitation. GitHub acknowledged this, emphasizing that the issue stems from how agents process external inputs without adequate session-level repository scoping or runtime policy enforcement. The company recommended adopting per-session repository access restrictions and dynamic security layers to mitigate such risks.
Attack Mechanism: Toxic Agent Flows via Prompt Injection
The attack leveraged a technique Invariant Labs termed a toxic agent flow, where an agent is manipulated into performing unintended actions through indirect prompt injection. In this case, the attacker created a malicious issue in a victim’s public repository containing a crafted prompt. When the user queried their agent—such as Claude Desktop with GitHub MCP integration—to review open issues, the agent processed the malicious payload.
- The user’s agent fetched the list of issues from the public repository, encountering the attacker’s malicious payload.
- The payload exploited the agent’s default behavior—either requiring user confirmation for tool calls or, in many cases, relying on an Always Allow policy—to execute unauthorized actions.
- The agent was tricked into accessing private repositories (e.g., containing proprietary code or sensitive data) and exfiltrating their contents into a pull request within the public repository.
- The leaked data became publicly accessible, exposing confidential information such as repository metadata, personal projects, and even sensitive details like salary records or relocation plans.
Invariant Labs validated this attack using demo repositories, including a public Pacman game implementation (ukend0464/pacman) and private repositories housing sensitive user data. The attack succeeded despite using Claude 4 Opus, a highly aligned and secure AI model, underscoring that even advanced models remain vulnerable to contextual manipulation when interacting with untrusted external inputs.
Architectural Limitations and Mitigation Strategies
GitHub classified this as an architectural flaw rather than a bug, stating that the MCP server itself was not compromised. The root cause lies in the lack of granular, runtime-enforced security boundaries for agent interactions with external platforms like GitHub. Traditional token-based permissions, while offering basic protection, fail to address dynamic threats where agents process untrusted data.
Invariant Labs proposed two key mitigation strategies to address this vulnerability:
- Per-Session Repository Scoping: Restrict agents to accessing only one repository per session, preventing cross-repository data leaks. This aligns with the principle of least privilege and can be enforced through dynamic policies, such as those provided by Invariant Guardrails. For example, a policy could block agents from switching repositories mid-session unless explicitly authorized.
- Runtime Policy Enforcement: Implement context-aware security layers that adapt to an agent’s workflow while enforcing strict boundaries. Tools like Invariant Guardrails allow organizations to define granular rules, such as preventing repository switches or unauthorized tool calls. These policies can be tested in environments like the Guardrails Playground before deployment.
Beyond preventive measures, Invariant recommended deploying specialized monitoring solutions to detect and respond to security threats in real time. Their MCP-scan tool, now with proxy mode support, enables organizations to audit MCP connections without modifying existing agent infrastructure. This provides visibility into potential security violations and creates an audit trail for incident response.
The vulnerability highlights a broader challenge in agent security: even state-of-the-art aligned models are susceptible to manipulation when interacting with untrusted environments. Security measures must extend beyond model-level safeguards to include system-level protections tailored to specific deployment contexts. Organizations integrating MCP or similar agent tools should prioritize dynamic, adaptive security controls to mitigate risks associated with toxic agent flows.