AIA-004 GitHub MCP server: private repo data leaked via a public issue, per Invariant Labs

ID: AIA-004
Category: AI AI agent incident
Disclosed: 2025-05
Systems: GitHub MCP server
Harm type: Data leak / prompt injection
Status: reported
Reported by the source; no vendor confirmation recorded in seed data.

Summary

Invariant Labs showed that a malicious public GitHub issue could steer an agent using the GitHub MCP server into putting private-repo contents into a public PR.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MAP 4.1 Risks from third-party components are mapped
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

AC-6 Least Privilege
AC-4 Information Flow Enforcement
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

yes: publishing to public repos

Sources

invariantlabs.ai primary link checked 2026-10-31, HTTP 200
Post dated 2025-05-26
https://invariantlabs.ai/blog/mcp-github-vulnerability

Corrections

2026-10-28 Verification round 1: date month and summary verified against the Invariant Labs post (2025-05-26).

To report an error in this entry, see corrections.