Collected research

GitHub MCP Exploited: Accessing private repositories via MCP

@invariantlabsai · 26 May 2025

Shows how prompt injection in a public GitHub issue can steer an MCP-enabled coding agent into reading data from a private repository and disclosing it in a public pull request. The chain crosses trust boundaries between untrusted repository content, tool calls, and authenticated GitHub access.

Record

Researcher

@invariantlabsai

Date

26 May 2025

In the archive

• Collected in the 2025 research round

Tags

• mcp
• prompt-injection
• ai-agent
• github
• data-exfiltration
• trust-boundary
• attack-chain
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of @invariantlabsai, first published at the original source. Preserved copies are kept so the citation survives its host.