By Null Ventures MCP platform
Menu

PRAE / Failure Ledger / NS-FL-0003

Public issue text redirected an agent into private repositories

GitHub MCP workflow, Invariant Labs demonstration

Researcher demonstrationPrimary sourceDisclosed 2025-05-26Reviewed 2026-10-29Primary gap: Permission

What happened

The researchers used demonstration repositories and an agent connected through GitHub MCP. Untrusted text in a public issue redirected a workflow that could both read private material and publish publicly.

Why it matters

A tool can perform its documented operation while the surrounding workflow violates the user’s intent. Review the combination of data access, external content and outbound actions, not each tool on its own.

What was affected

The agent, client, GitHub MCP integration and permissions in the demonstrated setup, which combined untrusted public issue text, access to private repositories and a public write channel in one workflow. The report gives no general affected-version range, and this entry does not declare present-day GitHub MCP installations vulnerable.

What to examine

  1. Grant access only to the repositories and operations the task needs. Separate private-data work from public publishing where practical.
  2. Treat retrieved issues and documents as data. Enforce operation and target boundaries outside the model, and require explicit review before anything sensitive is published.
  3. Test the boundary with synthetic private data and controlled untrusted content in an isolated environment. Inspect the proposed destination and the exact outgoing content.

Evidence to keep

  • The approved repository and operation allowlist
  • The configured permission and publication-approval rules
  • Synthetic test results showing the outbound action was blocked or reviewed

Scope and limits

This is a researcher demonstration, not evidence of a malicious breach of an unrelated customer. PRAE has not reproduced it. Permission design and current implementations need their own assessment.

Control mappings: NS-AIM-02, NS-AIM-04, NS-MCP-04. Mappings organize the lesson. They do not establish that any application meets those controls.

Sources

  1. Invariant Labs demonstration. Invariant Labs. The demonstrated workflow, its setup and its limits. Reviewed 2026-10-29.
  2. MCP security best practices. Model Context Protocol. Least-privilege scopes and operation-level authorization. PRAE’s recommendations apply those principles; they are not a universal fix. Reviewed 2026-10-29.