A public issue steered an agent through the GitHub MCP server into publishing private repository data

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0008

Kind

Injection

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• Invariant Labs states that an attacker can create a malicious issue on a public repository containing a prompt injection.
• The researchers state this is not a flaw in the GitHub MCP server code but an architectural issue that must be addressed at the agent system level.
• Their recommended mitigations are one repository per agent session and least privilege tokens, because there is no vendor patch for this class.
• A public issue on the GitHub MCP server repository records that the client confirmation dialog is weak because users approve without expanding the detail.
• GitHub separately hardened its editor agent with confirmations for files outside the workspace and before starting an MCP server.

Identity, Authorization, Delegation, Limits, Human approval, Revocation, Logging and audit. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

Any anonymous account could file the issue that the agent then treated as an instruction.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

AuthorizationSilent

One personal access token covered public and private repositories, so reading the attacker's issue and reading private code were the same authority.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

DelegationSilent

The agent held the developer's whole token rather than a grant scoped to the task, which the researchers name as the fix.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

LimitsSilent

Nothing capped cross repository reads inside one session.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

Human approvalOpen

A confirmation step exists in the client, but the public issue records that its collapsed preview makes the approval uninformed.GitHub, github-mcp-server issue 844, primary source, 8 August 2025.

RevocationSilent

No vendor patch removed the capability, and the researchers state the platform alone cannot resolve it.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

Logging and auditOpen

The exfiltration lands in a public pull request, which is durable evidence, but no detection control is documented.Invariant Labs, GitHub MCP exploited, primary source, 26 May 2025.

There is no patch coming for this one, which makes delegation the only control you own. Issue an agent a token scoped to the single repository it is working in, run one repository per session, and never let the same session hold public read and private read at once. Treat issue and pull request text as hostile input, because to your agent it is indistinguishable from your own instruction.

1. Invariant Labs, GitHub MCP exploitedPrimary · 26 May 2025
2. GitHub, github-mcp-server issue 844Primary · 8 August 2025
3. The GitHub Blog, Safeguarding VS Code against prompt injectionsPrimary · 25 August 2025
4. devclass, Researchers warn of prompt injection in GitHub MCPSecondary · 27 May 2025

• VerifiedInjectionAIL-2026-0009

  A support ticket steered a developer's assistant into reading a database through the Supabase MCP server

  United States · verified 15 September 2026

  General Analysis states that the editor assistant ingests untrusted customer text while holding service role privileges.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.

• VerifiedInjectionAIL-2026-0022

  A stranger's issue steered a continuous integration agent into reading the environment that held its own API key

  United States · verified 15 September 2026

  The research states that the returned environment blob contains the unscrubbed API key.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.