ApplicationMay 2025 – ongoing
GitHub MCP / agentic token breadth
Invariant Labs showed a malicious public issue can coerce an agent into pulling private repo data into context and leaking it via an autonomously created public PR, arguing this can't be fixed server-side and needs architectural controls. The pattern kept spreading: Orca's RoguePilot used a hidden prompt in an issue to make Copilot leak a repository's privileged token, and Noma's GitLost targeted agentic workflows handed a token with read access across an org's repos, private ones included. This is the clearest case where the token's scope breadth is the entire vulnerability. Nothing else needs to go wrong.
Permissions abused
Broad read-across-org token handed to an autonomous agent
On the permission reference
Sources
- researchGitHub MCP exploited: accessing private repositories via MCP
- researchgithub-mcp-server issue #844: token scope reproduction
- trackerPublic GitHub issue could trick agentic workflows into leaking private repo data
- researchMCP horror stories: the GitHub prompt injection data heist
- researchAI GitHub agents: how one issue leaked private repos
Reported by: Invariant Labs, Orca Security, Noma Security