{
 "type": "bundle",
 "id": "bundle--024aedc5-b6ba-517d-a252-7d4da6f25145",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--140607d9-ccca-5fe5-bc96-6f19243aa765",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "GitHub MCP 'toxic agent flow': a malicious public issue makes an AI agent leak private repos into a public PR",
   "description": "Invariant Labs showed that a prompt injection planted in an issue on a public repository is read by an AI agent connected through the GitHub MCP server when the owner asks it to triage open issues. The agent pulls data from the user's private repositories into context and opens a pull request in the public repo containing it, where the attacker can read it. The demonstration used Claude Opus via Claude Desktop and leaked a project name, a relocation plan and a salary figure. Invariant stresses this is not a bug in the MCP server's code and cannot be fully fixed server-side; it needs per-session least privilege and runtime monitoring. Choosing \"Always Allow\" removes the only confirmation step.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-012",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-012/"
    },
    {
     "source_name": "Invariant Labs",
     "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability",
     "description": "GitHub MCP Exploited: Accessing private repositories via MCP"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--535cf6d9-c3c0-5695-bb8c-eea98bb08e05",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "Security researchers (Invariant Labs: Marco Milanta, Luca Beurer-Kellner), proof of concept",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--db28b629-bb4c-5e5d-8b80-3611db545e95",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "No vendor patch; mitigation is least-privilege scoping and runtime guardrails (per the write-up)",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--d9f0e855-cd70-548d-b908-e8fdad28c4e5",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--7170d005-8550-5c2d-b1a8-702d2548cca5",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "TA0009 Collection",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0009"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--4f2ca289-ef50-5a5d-9ff4-02b14f289a55",
   "created": "2025-05-26T00:00:00.000Z",
   "modified": "2025-05-26T00:00:00.000Z",
   "name": "TA0010 Exfiltration",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0010"
    }
   ]
  }
 ]
}