May 26, 2025
Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data
Invariant Labs demonstrated that a malicious issue in a public repository could lead an agent using the GitHub MCP server to read the user's private repositories and publish the data in a public pull request. The firm tested with Claude 4 Opus and argues there is no server-side patch because the flaw lies in agent permissions, recommending per-session repository scoping and runtime monitoring.