Chronicle/Attacks & incidents

Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

Jan 20, 2026AttackVulnerability disclosureSignificance assistant-drafted

Cyata found path-validation and argument-injection flaws in Anthropic's mcp-server-git (CVE-2025-68143, -68144, -68145) that, chained with the Filesystem MCP server, allowed file access and code execution by anyone able to influence what the assistant reads. Anthropic removed the git_init tool and added path validation in fixed releases.

Why it matters

Even the protocol author's reference servers carried injection-reachable code execution paths.

Key facts

As stated in the sources, with where to find them.

CVE-2025-68143 fixed in mcp-server-git version 2025.9.25; CVE-2025-68144 and CVE-2025-68145 fixed in version 2025.12.18, per The Hacker News.The Hacker News, CVE list

Findings that cite this record

No tracked finding cites this record yet.

Key questions this bears on

Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.

Sources

Cyata Research: Breaking Anthropic’s Official MCP ServerCyataJan 20, 2026Primary sourceAccessed Sep 26, 2026
GHSA-5cgr-j3jf-jw3vModel Context Protocol servers (GitHub security advisory)Dec 17, 2025Primary sourceAccessed Sep 26, 2026
GHSA-9xwc-hfwc-8w59Model Context Protocol servers (GitHub security advisory)Dec 17, 2025Primary sourceAccessed Sep 26, 2026
GHSA-j22h-9j4x-23w5Model Context Protocol servers (GitHub security advisory)Dec 17, 2025Primary sourceAccessed Sep 26, 2026
Three Flaws in Anthropic MCP Git Server Enable File Access and Code ExecutionThe Hacker NewsJan 20, 2026Secondary sourceAccessed Sep 25, 2026

Related records

Apr 15, 2026

OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

AttackVulnerability disclosureOX Security, Anthropic

May 7, 2026

Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution

AttackVulnerability disclosureMicrosoft

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

AttackVulnerability disclosureAim Security, Cursor

Feb 5, 2026

Claude Opus 4.6 system card reports prompt injection rates by surface, attempts and safeguards

DefenseSystem cardAnthropic, Gray Swan AI

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Organizations: Cyata, Anthropic
Topics: Tools & MCP Prompt injection
Attack surface: Tools & MCP Untrusted content Execution sandbox
Methods: Indirect prompt injection Tool and MCP poisoning
Record: cyata-anthropic-git-mcp-server-cves-2026 · added 2026-09-25

Cite this record

Fide AI. "Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection." Agentic Cyber Explorer, record cyata-anthropic-git-mcp-server-cves-2026. https://agentic-cyber-explorer.pages.dev/events/cyata-anthropic-git-mcp-server-cves-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-cyata-anthropic-git-mcp-server-cves-2026,
  author = {{Fide AI}},
  title = {Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/cyata-anthropic-git-mcp-server-cves-2026/},
  note = {Record cyata-anthropic-git-mcp-server-cves-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.