GitHub MCP server hijacked via a public issue to leak private repository data

Users of the official GitHub MCP integration·GitHub MCP server (via Claude Desktop / Claude 4 Opus)Unresolved

Invariant Labs planted a malicious prompt inside a GitHub Issue on a public repository; when the agent was asked to review open issues, it followed the hidden instructions, pulled private-repository data (including salary and relocation plans) into context, and leaked it in an autonomously created pull request on the public repo.

Blast radius

Full read access to a user's private repositories exfiltrated into a publicly accessible PR; the vulnerability affects any agent using GitHub MCP regardless of model, not just Claude.

Root cause

The agent trusted content pulled from an external, attacker-writable surface (a public GitHub issue) as if it were user instructions, a 'toxic agent flow' that persists even with fully trusted tools.

How it was caught

Discovered by Invariant Labs' automated toxic-agent-flow security scanner, not caught in production before disclosure.

What changed

No server-side fix possible; Invariant recommends per-repo session isolation and continuous MCP traffic monitoring (mcp-scan) as mitigations.

Take-awayScope agent tool credentials to a single repository/session and treat externally-writable fields (issues, comments) as untrusted input.