😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked. We discovered a new attack on agents using GitHub’s official MCP server, which can be exploited by attackers to access your private repositories. creds to @marco_milanta (1/n) 👇
GitHub MCP gives your Claude (or other agent) full access to your GitHub repository. This means all repos (private or public), and the ability to check issues, create PRs, etc. Now, if an attacker places a malicious issue in one of your repos, they can easily hijack your agent and go wild with that.
To demonstrate, we created a simple issue asking for 'author recognition', to prompt inject the agent into leaking data about the user's GitHub account. What can I say ... this was all it needed.
After some tool calls, Claude creates a PR, leaking everything. This includes: full names, travel plans, salary, list of private repos, etc.
The good news: This is the first time our threat-focused Invariant security scanners have automatically identified such a 'toxic flow' in a real-world, popular MCP server (Github MCP has 14k stars). In the future we can thus threat model and secure much more systematically.
Regarding mitigations, we don't see GitHub MCP at fault here. Rather, we advise for two key patterns: (1) restrict agent permissions as much as possible (2) continuously audit and monitor your agent and MCP connections More details in the blog: #mitigations class="text-blue-500 hover:underline" target="_blank" rel="noopener noreferrer">https://invariantlabs.ai/blog/...
Learn more in our blog post: https://invariantlabs.ai/blog/... Also, check the malicious issue here: https://github.com/ukend0464/p... (the agent even responds very happily after leaking the data, see below).
