Malicious GitHub issue steers agents into leaking private repository data

Timeline

• 2025-05-26. Invariant Labs publishes its findings.
• 2025-05-27. DevClass reports on them.

Trigger or entry point

An issue that the attacker opens in a public repository owned by the victim.

Failure mechanism

The user asks their agent to review open issues in the public repository. The agent reads the malicious issue and follows the instructions in it. Because the same session has access to the user’s private repositories, the agent pulls data from them and writes it into a pull request on the public repository. Invariant Labs states that this is “not a flaw in the GitHub MCP server code itself” but an architectural issue. It affects any agent that uses the server, whichever model it runs. DevClass describes the server as “working as designed”: each tool call is legitimate on its own, and the harm comes from the combination.

Impact

The demonstration used Claude 4 Opus in Claude Desktop and leaked details from private repositories, including a project name and personal information about the user. The severity is potential. The attacker needed no access to the private repositories. The ability to open an issue on the public repository was enough.

Response

Neither source reports a response from GitHub. DevClass mentions an open issue on the server’s repository that proposes a filter, and reports no reply from GitHub.

Mitigations

Invariant Labs recommends tokens limited to the repositories an agent needs, and one repository per session. Both sources say these measures are not a complete fix.