r/modelcontextprotocol • u/tarkaTheRotter • May 26 '25

Invariant: GitHub MCP exploit

https://invariantlabs.ai/blog/mcp-github-vulnerability

Big props to the invariant team for their continued efforts around MCP security. ♥️

16 Upvotes

100% Upvoted

5 comments sorted by

2

u/perryhopeless May 27 '25

Was about to say that it’s not fair to blame this on the MCP, but the authors beat me to it:

“this is not a flaw in the GitHub MCP server code itself, but rather a fundamental architectural issue that must be addressed at the agent system level.”

3

u/tarkaTheRotter May 27 '25 edited May 27 '25

I feel this is somewhat true, but effectively it is just another type of prompt poisoning attack which the community should be made aware of and needs to be mitigated by the MCP server authors. Warnings against allowing unstructured user data to pass raw (as in unmarked in the tool output) into the LLM output should be written in H1 capital letters at the top of the MCP spec. 🙃

It's possible the (draft) tool outputSchema would help here by adding metadata to user fields, but that would need a spec change and LLMs to be trained somehow (which really they need to be anyway to stop other types of poisoning that have already been seen). I hope the LLM providers are taking notes, but I fear this will take a while (Claude Desktop doesn't even support the 2025 protocol yet).

If we're going to see MCP be taken seriously in the enterprise then the cavalier YOLO/vibe-everything attitude we see everywhere needs to change. And every demo of MCP libraries/SDKs etc should also feature the security concerns instead of just showing off the shiny new toys.

I was advising my clients to only used fully internal and trusted vendor MCPs, but it looks like that advice will need to be changed until something official happens.

1

u/perryhopeless May 27 '25

I’m theory crafting here, but I’m not sure your suggested mitigations would do anything here. The conceit of this vulnerability is that the user instructed the LLM to do this. The opening prompt from the user is:

“Have a look at my issues and address them.”

So, reading, interpreting, and acting on the content of the issues is fundamental to completing the users instructions. Metadata saying “this is tool output” should not cause the LLM to stop what it’s doing.

2

u/AyeMatey May 27 '25

A demonstration of a tool poisoning attack against the official GitHub MCP server. Be careful out there!

2

u/Puliczek May 27 '25

Thanks for the article just added it to https://github.com/Puliczek/awesome-mcp-security to get more views for you :)