In May 2025, security researchers at Invariant Labs showed that an attacker could steal private repositories by filing a GitHub issue. No exploit, just a sentence.
The target was an assistant connected to GitHub through the official MCP server. It read an issue in a public repo that carried hidden instructions, pulled data from the developer’s private repos, and posted it into a public pull request.
A few weeks later, Aim Security disclosed EchoLeak, a flaw in Microsoft 365 Copilot. A single crafted email could pull data from a victim’s mailbox, files and chats with zero clicks. It was tracked as CVE-2025-32711 and rated 9.3. Microsoft patched it and said customers were unaffected.
Different products, same shape. Simon Willison named it in June 2025: the lethal trifecta. An agent that has access to your private data, is exposed to untrusted content, and can communicate externally can be told, by any text it reads, to send your data out. The model follows instructions in content and cannot reliably tell which ones came from you.
Run three questions against every agent you ship.
What private data can it reach? List the scopes: tokens, repos, inboxes, databases. If the answer is “whatever the user can,” that is a yes.
What untrusted text can reach it? Emails, issues, tickets, web pages, PDFs, support chat, another agent’s output. Anything an outsider can write.
How can it send something out? Pull requests, comments, emails, webhooks, tool calls to arbitrary URLs, even remote images or links that trigger a fetch.
Three yeses means it can be exploited. Not might.
The fix is to remove a leg, not to add a guardrail. Willison calls a defense that stops 95% of attacks a failing grade by web security standards.
Cut the data leg. Scope tokens to the one repo or mailbox the task needs. The GitHub attack only works because private data is reachable from the session that reads public issues.
Cut the untrusted leg. For anything that touches private data, feed it only content you control. One GitHub thread proposed exactly this for the MCP server: show the agent only issues and comments from users who already have push access.
Cut the outbound leg. No network egress by default, an allowlist of domains, no rendering of remote images, and a human approval step on anything that posts, sends or opens a PR.
Better still, split the work. One agent reads the outside world and holds no secrets and no outbound channel. A second holds the secrets and only accepts structured, validated output from the first. No single agent ever has all three.
Run the test on everything you’ve shipped, then write the answers in the repo next to the owner’s name.
Which leg couldn’t you cut? Tell me in the comments.
Andrew Quillen is the founder of AndMaverick, a global Enterprise AI Orchestration consultancy. To continue the conversation, visit andmaverick.com.