A public GitHub issue makes your agent leak private repos
Invariant Labs showed a malicious issue could steer an agent using the GitHub MCP server into publishing private repo data in a public PR.
- Agents
- GitHub MCP server, Claude Desktop
- Reported
- Source checked
- Tags
- mcp, github, exfiltration
Symptom
After you ask the agent to look at open issues, a new PR on a public repo contains details from your private repositories.
Cause
One token gave the agent access to private data, the agent read untrusted text (the issue), and it could write publicly. Together, those let injected instructions exfiltrate data.
Fix
Give agents fine-grained tokens scoped to a single repo, keep approval on write tools, and avoid sessions that mix untrusted public content with private access.
GitHub fine-grained token for an agent session
- Repository access: Only select repositories -> the one repo
- Contents: Read-only
- Pull requests / Issues: Read-only unless the task needs writes
- Never: "All repositories" for an agent reading public issues