Prompt Injection Bugs Found in Official Anthropic Git MCP Server
2026-01-20
Infosecurity Magazine
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Researchers discovered three prompt injection vulnerabilities in Anthropic's official Git MCP server, allowing attackers to manipulate AI assistants into executing code, accessing, or deleting files without direct system access. The flaws, affecting all versions before December 2025, posed significant security risks but have since been fixed.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (Anthropic's MCP server integrating large language models with system tools) whose malfunction and improper input validation allow attackers to exploit prompt injection vulnerabilities. These vulnerabilities enable attackers to execute code, delete files, and expose sensitive data indirectly through the AI system's context processing. The harm includes security and privacy risks, which fall under harm to property and communities. The vulnerabilities have been confirmed and fixed, indicating the harm is realized or imminent. Hence, this is an AI Incident rather than a hazard or complementary information.[AI generated]