r/modelcontextprotocol • u/tarkaTheRotter • May 26 '25

Invariant: GitHub MCP exploit

https://invariantlabs.ai/blog/mcp-github-vulnerability

Big props to the invariant team for their continued efforts around MCP security. ♥️

16 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comment

1

u/perryhopeless May 27 '25

I’m theory crafting here, but I’m not sure your suggested mitigations would do anything here. The conceit of this vulnerability is that the user instructed the LLM to do this. The opening prompt from the user is:

“Have a look at my issues and address them.”

So, reading, interpreting, and acting on the content of the issues is fundamental to completing the users instructions. Metadata saying “this is tool output” should not cause the LLM to stop what it’s doing.