{
 "id": "TR-2026-012",
 "status": "published",
 "title": "GitHub MCP 'toxic agent flow': a malicious public issue makes an AI agent leak private repos into a public PR",
 "date": "2025-05-26",
 "window": "Published 26 May 2025 by Invariant Labs",
 "ai_role": "target",
 "category": "red_team",
 "summary": "Invariant Labs showed that a prompt injection planted in an issue on a public repository is read by an AI agent connected through the GitHub MCP server when the owner asks it to triage open issues. The agent pulls data from the user's private repositories into context and opens a pull request in the public repo containing it, where the attacker can read it. The demonstration used Claude Opus via Claude Desktop and leaked a project name, a relocation plan and a salary figure. Invariant stresses this is not a bug in the MCP server's code and cannot be fully fixed server-side; it needs per-session least privilege and runtime monitoring. Choosing \"Always Allow\" removes the only confirmation step.",
 "attacker": {
  "description": "Security researchers (Invariant Labs: Marco Milanta, Luca Beurer-Kellner), proof of concept"
 },
 "defender": {
  "description": "No vendor patch; mitigation is least-privilege scoping and runtime guardrails (per the write-up)"
 },
 "scale": "Any private repository reachable by the connected account",
 "impact": "Cross-repository leak of private source and details via a public PR",
 "tactics": [
  "TA0001",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-05-26",
   "text": "Invariant Labs publishes the toxic-agent-flow write-up with a Claude Desktop + GitHub MCP demonstration",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "A public issue is attacker-controlled input to any agent that reads it; triaging issues is an injection surface.",
  "Model alignment did not save it — an aligned model was still manipulated; the control is scoping what the agent can reach per session.",
  "'Always Allow' turns the one confirmation into no confirmation; design flows that don't depend on the user catching each call."
 ],
 "models_named": [
  {
   "name": "Claude Opus",
   "role": "target",
   "note": "via Claude Desktop in the demonstration"
  }
 ],
 "related_agents": [],
 "vendor_response": "No server-side patch; Invariant recommends granular permissions and MCP traffic monitoring",
 "sources": [
  {
   "title": "GitHub MCP Exploited: Accessing private repositories via MCP",
   "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability",
   "outlet": "Invariant Labs",
   "date": "2025-05-26"
  }
 ],
 "reviewer": null,
 "checked_on": null
}