Critical Vulnerability in GitHub MCP Integration Leaks Private Repo Data

Invariant has discovered a critical vulnerability in the widely-used GitHub MCP integration (14k GitHub stars). A malicious GitHub Issue allows attackers to hijack a user's agent, forcing it to leak data from private repositories. This vulnerability, one of the first discovered by Invariant's automated security scanners for detecting 'Toxic Agent Flows,' involves injecting malicious prompts into a public repository. When a user queries their agent, it fetches the issue and is injected, potentially pulling private repo data into context and leaking it to a public repository accessible to the attacker. Mitigation strategies include granular permission controls and continuous security monitoring. Even highly aligned AI models are susceptible, highlighting the need for system-level security measures.