Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-012

agent was the target · researcher disclosure · unreviewed

GitHub MCP 'toxic agent flow': a malicious public issue makes an AI agent leak private repos into a public PR

Invariant Labs showed that a prompt injection planted in an issue on a public repository is read by an AI agent connected through the GitHub MCP server when the owner asks it to triage open issues. The agent pulls data from the user's private repositories into context and opens a pull request in the public repo containing it, where the attacker can read it. The demonstration used Claude Opus via Claude Desktop and leaked a project name, a relocation plan and a salary figure. Invariant stresses this is not a bug in the MCP server's code and cannot be fully fixed server-side; it needs per-session least privilege and runtime monitoring. Choosing "Always Allow" removes the only confirmation step.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-05-26 Invariant Labs publishes the toxic-agent-flow write-up with a Claude Desktop + GitHub MCP demonstration · Invariant Labs T2

What defenders can take from it

  1. A public issue is attacker-controlled input to any agent that reads it; triaging issues is an injection surface.
  2. Model alignment did not save it — an aligned model was still manipulated; the control is scoping what the agent can reach per session.
  3. 'Always Allow' turns the one confirmation into no confirmation; design flows that don't depend on the user catching each call.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.