GitHub MCP Prompt Injection: How a Public Issue Leaked Private Repositories
Key takeaways
- →Invariant Labs showed that an agent connected to the GitHub MCP server could be hijacked by a malicious issue in a public repo.
- →The agent then read the user's private repositories and leaked the data through a public pull request.
- →AgentGuard blocks data flows that cross trust boundaries when the task doesn't require it.
- 1
Attacker files malicious public issue
- 2
User asks agent to review issues
- 3
Agent follows embedded instructions
- 4
Agent reads private repositories
AgentGuard blocks private-to-public data flow that doesn't fit the issue-triage task
- 5
Data published in public PR
- Affected
- Users of AI agents with GitHub MCP access (research demonstration)
- When
- May 2025
- Impact
- Private repository data exposed via public PR
What happened
In May 2025 Invariant Labs disclosed a 'toxic agent flow' affecting agents that use the GitHub MCP server. A malicious issue in a public repository contained instructions. When the user asked their agent to look at open issues, the agent followed them, fetched data from private repositories and wrote it into a pull request on the public repo.
Why it's structural
The MCP server worked as designed. The token had access to both public and private repositories. The flaw is that nothing evaluated whether moving data from private to public served the user's request.
How AgentGuard would have stopped it
AgentGuard labels data by trust boundary and tracks it through agent tool calls. Reading private repository content during a public-issue triage task, then writing it into a public artifact, is a cross-boundary flow with no task justification. It's blocked in real time.
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentGuard was built to close, with zero integration and deployment measured in days.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.