A public GitHub issue coaxed an agent into leaking private code

An AI agent connected to GitHub's official MCP server could be manipulated into reading a user's private repositories and publishing their contents, Invariant Labs reported in May 2025. The attack needed nothing more than a specially written issue in a public repository the user asked the agent to look at.

In the demonstration, a user asked an agent to review open issues on a public project. One issue contained instructions telling the agent to look through the author's other repositories, collect personal information and code, and add it to a new pull request on the public project. The agent complied. Because the GitHub token it used had access to both public and private repositories, nothing stopped the data from moving between them.

Invariant described the pattern as a "toxic agent flow" rather than a bug in the MCP server itself. The server behaved as designed; the problem was combining a broadly scoped credential with input the user did not control.

GitHub's public documentation for the server subsequently emphasised fine-grained tokens with the narrowest possible scope. Invariant recommended runtime policies that prevent a single agent session from touching more than one repository, and tooling that flags cross-repository data movement.

The report was one of the earliest widely discussed demonstrations against MCP-based tooling and was followed within weeks by similar findings against other servers, including Supabase and Atlassian integrations.