Security

Every component did what it was built to do, and private code still ended up in a public pull request. A developer had connected an agent to GitHub's official MCP server with a personal access token and asked it to look at the open issues in a public repository. One of those issues, planted by researchers at Invariant Labs in May 2025, contained instructions addressed to any AI agent that might read it. The agent read them as instructions, used the token to read the developer's private repositories, and opened a pull request in the public repository containing what it had found. The server executed calls the token allowed, the model followed text it was given, and the token could reach every repository its owner could.