Researchers detail an exploit in GitHub's official MCP server that lets hackers trick an LLM agent into leaking private information about the MCP user
Attackers only need to open a malicious issue on the targeted repositories to exploit the vulnerability. — invariantlabs.ai/blog/mcp-git... Daniel Cuthbert / @dcuthbert : We are truly back in the 1990s when it comes to validation and processing said dirty data — invariantlabs.ai/blog/mcp-git... Lukasz Olejnik / @lukaszolejnik : CRITICAL vulnerability in AI software engineering layer (MCP server of Github). Expect many, many more of such issues. This is a first real-world demonstration of how agents can be hijacked, leaking secret or private data. invariantlabs.ai/blog/mcp-git... [image] Kenn White / @kennwhite : Just the tip of the iceberg from this roll-your-own security protocol. We're about to usher in a golden age of Valhalla-level AI pwnage, and it'll be riding on the coattails of badly designed agents. — invariantlabs.ai/blog/mcp-git... Simon Willison / @simonwillison.net : GitHub MCP suffers from the lethal trifecta for prompt injection: access to private data, exposure to malicious instructions + the ability to exfiltrate information — Be really careful with this stuff: attackers can trick your “agent” into stealing your private data simonwillison.net/2025/May/26/ ... … Mastodon: @tante@tldr.nettime.org : This is just one example. “MCP” the protocol for “AI agents” is basically without security measures. It's like running random code on your infrastructure and data. — (Original title: GitHub MCP Exploited: Accessing private repositories via MCP) — https://simonwillison.net/... @mttaggart@infosec.exchange : Lol, lmao, etc. — You know at some point putting things on GitHub has to be considered a liability. — https://invariantlabs.ai/... Mike Sax / @mikesax@mas.to : “My best advice is to be **very careful** if you're experimenting with MCP as an end-user.” — @simon willison — https://simonwillison.net/... Simon Willison / @simon@fedi.simonwillison.net : The GitHub MCP server suffers from the lethal trifecta for prompt injection: access to private data, exposure to malicious instructions + the ability to exfiltrate information — Be really careful with this stuff: attackers can trick your “agent” into stealing your private data https://simonwillison.net/... X: Luca Beurer-Kellner / @lbeurerkellner : 😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked. We discovered a new attack on agents using GitHub's official MCP server, which can be exploited by attackers to access your private repositories. creds to @marco_milanta (1/n) 👇 [image] John Halloran / @convexdad : @lbeurerkellner @marco_milanta Interesting, good find. We found similar privacy leakage issues with the Slack MCP server, which could even be compromised through external manipulation. Attacks go beyond privacy leakage, e.g., remote systems access. More details: https://www.arxiv.org/... Forums: Hacker News : GitHub MCP exploited: Accessing private repositories via MCP r/programming : GitHub MCP Exploited: Accessing private repositories via MCP Lobsters : GitHub MCP Exploited: Accessing private repositories via MCP
Context & Ripple Effects
GitHub already sits at the intersection of public repository activity and sensitive developer data: earlier coverage found that repositories once made public could remain reachable through Copilot. This exploit adds a different route—untrusted repository content influencing an agent that can access a user’s private context.
The report also follows growing evidence that LLMs change software-security workflows, including a researcher’s use of OpenAI’s o3 to find a Linux SMB zero-day. The key distinction here is that the model is not only analyzing code; it is acting through an MCP connection with access to user data.
First-order effects
- GitHub MCP users who let an agent process repository issues face a direct prompt-injection path: a malicious issue can induce the agent to disclose private repository or user information.
- GitHub and MCP-server operators must treat issue text and other fetched repository content as untrusted input, rather than as instructions an agent may safely follow.
Second-order effects
- Teams deploying coding agents will need tighter tool permissions, approval gates for sensitive reads, and isolation between public repository inputs and private data sources—potentially reducing the autonomy of current workflows.
- The reported similar leakage risk in Slack MCP means the remediation burden extends beyond GitHub: MCP integrations that combine external content with privileged tools become comparable attack surfaces.
Third-order effects
- If this pattern persists, agent security will shift from protecting model prompts alone toward enforcing least-privilege, identity-aware controls around every tool call and data retrieval.
- MCP adoption may increasingly depend on whether platforms can make untrusted-content handling and auditable agent actions enforceable defaults, rather than configuration left to individual users.
The trend: This is part of the expanding agentic attack surface, where natural-language inputs can steer software agents across previously separate trust boundaries.