Invariant Labs discloses prompt-injection vulnerability in GitHub's MCP server

Invariant Labs disclosed an attack against GitHub’s official Model Context Protocol (MCP) server, the tool more than 14,000 GitHub-starred integration that lets AI agents such as Claude Desktop act on a user’s GitHub account. The researchers showed that an attacker could plant prompt-injection instructions inside an ordinary GitHub issue on a public repository. When a user asked their agent to review issues on that repository, the agent read the malicious issue, followed its embedded instructions, and — because it retained access to the same user’s private repositories in the same session — pulled out sensitive information including private repository names, salary figures and personal relocation plans, then opened a public pull request exposing them.

Invariant Labs called this pattern a “toxic agent flow”: an agent combining a trusted tool, untrusted external content and access to private data in one context, so that content it merely reads can steer what it subsequently does with data it should not share. The firm was explicit that this was not a bug in GitHub’s MCP server code — the server behaved as designed — but an architectural property of connecting agents to multiple data sources with no isolation between what is trusted and what is not, meaning no server-side patch could fully close it.

The disclosure was one of a growing number of demonstrated attacks against agents wired up via MCP, the protocol Anthropic had introduced months earlier to standardise how AI systems connect to external tools, and it became a frequently cited example in the following year’s discussion of agentic-AI security as adoption of MCP-connected coding agents grew faster than defences against indirect prompt injection.