Incident file · Security
GitHub MCP server: a public issue reads your private repos (2025)
private-data exfiltration via public pull request, lethal-trifecta pattern
The system
GitHub's official MCP (Model Context Protocol) server, with roughly 14,000 GitHub stars at the time of disclosure, lets AI coding agents like Claude read and act on a user's GitHub account: list and read issues, read repository contents (public and private, depending on token scope), and open pull requests. A developer typically authorizes it once with a token or OAuth grant that covers all repositories the token's owner can access, then asks the agent to "look at the issues" in a given repo.
What was observed
Invariant Labs (Marco Milanta, Luca Beurer-Kellner) disclosed on 26 May 2025 that simply asking an agent to look at issues in a public repository could result in the names and contents of the user's private repositories being published into a pull request visible to the public, including to the attacker. No unusual command was issued by the user; the trigger was an ordinary, routine request to review issues.
Stop and think
- What single credential does the MCP server hold, and does that credential distinguish between "read this public repo's issues" and "read all of this user's private repos"?
- If the model session has already read private data earlier in the same conversation, what checkpoint (if any) exists before it is allowed to write that data somewhere public?
- The user's agent client had an "Always Allow" setting enabled. What is the actual security function that setting removes, and who typically enables it?
Answer the questions above before you read on: what failed, why, and what would have stopped it.