Desk/2025-W22

Week of May 26 – Jun 1, 2025

1 records0 status changes on new evidence1 new findings

New findings

May 26, 2025

An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.

Corroboratedmeasured5 evidence records

Attacks & incidents

May 26, 2025

Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

AttackVulnerability disclosureInvariant Labs, GitHub

Invariant Labs demonstrated that a malicious issue in a public repository could lead an agent using the GitHub MCP server to read the user's private repositories and publish the data in a public pull request. The firm tested with Claude 4 Opus and argues there is no server-side patch because the flaw lies in agent permissions, recommending per-session repository scoping and runtime monitoring.