GITHUB MCP EXPLOITED: ACCESSING PRIVATE REPOSITORIES VIA MCP

Summary from the TLDR InfoSec newsletter

A critical vulnerability in GitHub's MCP integration allows attackers to use prompt injection in public issues to trick coding agents (e.g., Claude) into leaking data from private repositories. This exploit, termed a "toxic agent flow," does not rely on compromised tools but exploits trusted agents' interactions with untrusted external content. The issue requires system-level mitigations—like runtime guardrails and continuous MCP traffic monitoring—since model-level alignment is insufficient to prevent such context-driven attacks.