GitHub MCP Server Vulnerable to Prompt Injection Attacks, Researchers Warn Researchers at Zurich-based Invariant Labs have identified a prompt injection vulnerability in GitHub’s Model Context Protocol (MCP) server, which could expose sensitive code from private repositories. The issue stems from an architectural flaw rather than a coding error, allowing attackers to manipulate AI agents into leaking confidential data. The attack scenario involves a developer working across both public and private repositories, with an AI agent granted access to the private ones. An attacker posts a malicious issue in a public repository—containing hidden prompts instructing the AI to extract and publish private repository data. When the developer tasks the AI with reviewing the public repository, the agent unknowingly executes the malicious instructions, exposing private code. While the MCP server operates as designed, the attack is low-complexity and high-impact, with no straightforward fix. Researchers suggest mitigations, such as limiting AI agents to one repository per session and enforcing least-privilege access tokens, but these are not foolproof. Open-source developer Simon Willison described the flaw as a "lethal trifecta" for prompt injection, combining private data access, malicious instruction execution, and exfiltration capabilities. Prompt injection—where malicious instructions are embedded in seemingly benign data—remains difficult to prevent due to the unstructured nature of AI interactions. Despite warnings dating back over two years, effective defenses are still lacking. A proposed MCP server update would filter contributions to only those from users with push access, but this could block legitimate input. GitHub’s MCP server, currently in preview (v0.4.0), is open-source, and the vulnerability highlights broader challenges in securing AI-driven development tools. The incident underscores the need for stricter access controls and better prompt injection defenses as AI integration in software development expands.