Prompt In, Shell Out: Exploiting GitHub AI Toolchains
· 7 min read
A developer sits down, opens their AI assistant, and asks a completely normal question:
“What are the open issues in my repo?”
Thirty seconds later, their SSH private key is on an attacker's server.
They never clicked a link.
They never ran a script.
They never left their IDE.
In our security research, we identified a command injection flaw in a GitHub MCP server which could enable remote code execution (RCE) on a developer's machine, with no user interaction beyond asking about open issues.