Hub/AI Security/Advisories/github-mcp-toxic-flow-2025

GitHub MCP prompt injection leaks private repos via a malicious public issue

Invariant Labs showed an agent with a broad GitHub token reading a malicious issue and leaking private repo data into a public PR. It's an agent-design issue with no single patch.

Published	May 26, 2025
Severity	Not Rated
CVE	None assigned
Status	research
Affected	Not listed
Fixed in	Not listed
Component	GitHub MCP server + any agent

Sources

https://invariantlabs.ai/blog/mcp-github-vulnerability

Checked 2026-11-04. We copy severity and fix versions from the source and never estimate them.

Affected tools

GitHub Copilot MCP protocol, SDKs and registry Security posture matrix

Weekly, free

What changed in AI integrations

One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.