Luca Beurer-Kellner

😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked.

We discovered a new attack on agents using GitHub’s official MCP server,  which can be exploited by attackers to access your private repositories.

creds to @marco_milanta

(1/n) 👇 

GitHub MCP gives your Claude (or other agent) full access to your GitHub repository. 

This means all repos (private or public), and the ability to check issues, create PRs, etc.

Now, if an attacker places a malicious issue in one of your repos, they can easily hijack your agent and go wild with that.

To demonstrate, we created a simple issue asking for 'author recognition', to prompt inject the agent into leaking data about the user's GitHub account.

What can I say ... this was all it needed. 

After some tool calls, Claude creates a PR, leaking everything. 

This includes: full names, travel plans, salary, list of private repos, etc. 

The good news: This is the first time our threat-focused Invariant security scanners have automatically identified such a 'toxic flow' in a real-world, popular MCP server (Github MCP has 14k stars).

In the future we can thus threat model and secure much more systematically.

Regarding mitigations, we don't see GitHub MCP at fault here. Rather, we advise for two key patterns:

(1) restrict agent permissions as much as possible
(2) continuously audit and monitor your agent and MCP connections

More details in the blog: https://invariantlabs.ai/blog/mcp-github-vulnerability#mitigations

Learn more in our blog post: 
https://invariantlabs.ai/blog/mcp-github-vulnerability

Also, check the malicious issue here: https://github.com/ukend0464/pacman/issues/1 (the agent even responds very happily after leaking the data, see below). 

👿 MCP is all fun, until you add this one malicious MCP server and forget about it.

We have discovered a critical flaw in the widely-used Model Context Protocol (MCP) that enables a new form of LLM attack we term 'Tool Poisoning'.

Leaks SSH key, API keys, etc.

Details below 👇 

When an MCP server is added to an agent like @cursor_ai, Claude or the @OpenAI  Agents SDK, its tool's descriptions included in the context of the agent.

This opens the doors wide open for a novel type of indirect prompt injection, we coin tool poisoning. 

What's concerning about this, is that AI models are trained to precisely follow those instructions, rather than be vary about them. This is new about MCP, as before, agent developers could be relatively trusted, now everything is fair game.

It's trivial to craft a malicious tool description like below, that completely hijacks the agent, while pretending towards the user everything is going great. 

Lastly, not only can you expose malicious tools, tool descriptions can also be used to change the agent's behavior with respect to other tools, which we call  'shadowing'. 

This way all you emails suddenly go out to 'attacker@pwnd.com', rather than their actual receipient. 

We wrote up a little report about this, to raise awareness. Please have a look for much more details and scenarios, and our code snippets.

Blog: https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

Some extended thoughts after reading some of the reactions:

https://x.com/lbeurerkellner/status/1907431244414980181