Case anthropic-git-mcp-injectionPrompt injectionWorldwide
Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution
Researchers showed malicious repository content could steer agents using Anthropic's reference Git MCP server into reading or deleting files and running code; fixes shipped.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 20, 2026
- Location
- Worldwide
- Target
- Anthropic mcp-server-git
- Severity
- Medium
- Triggered by
- Cyata security researchers (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-68143, CVE-2025-68144, CVE-2025-68145
What happened
Researchers showed malicious repository content could steer agents using Anthropic's reference Git MCP server into reading or deleting files and running code; fixes shipped.
Impact: Proof of concept allowing arbitrary file read, file deletion and, chained with the filesystem MCP server, code execution on agent hosts. No victims reported.
Who triggered it
Actor: Cyata security researchers (responsible disclosure)
Attribution: Self-disclosed by Cyata; fixes acknowledged by Anthropic
Motive: Security research; no in-the-wild exploitation reported
How it happened
Attack vector: Prompt injection via malicious README, issue text or webpage steering an agent to call git_init, git_diff with injected flags, or out-of-scope repository paths
Root cause: Missing path validation on repo_path, unrestricted git_init and unsanitized git_diff target argument passed to the git CLI
Timeline
- Cyata begins reporting the issues to Anthropic (June-July)
- Anthropic releases mcp-server-git 2025.12.18 fixing all three flaws
- Cyata and media publish details
Response
Anthropic validated repository paths, removed the git_init tool and fixed argument injection; users told to upgrade to 2025.12.18 or later.
Current status: Patched
Sources (open in a new tab)
- OECD AI Incidents Monitor oecd.ai
- The Register theregister.com
- SecurityWeek securityweek.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution. AI Threat Watch, case anthropic-git-mcp-injection, Jan 20, 2026. https://aithreat.io/cases/anthropic-git-mcp-injection/
Permanent link: https://aithreat.io/cases/anthropic-git-mcp-injection/