I guess I don't really get the attack. The idea seems to be that if you give your Claude an access token, despite what you tell it that it's for, Claude can be convinced to use it for anything that it's authorized for.
I think that's probably something anybody using these tools should always think. When you give a credential to an LLM, consider that it can do up to whatever that credential is allowed to do, especially if you auto-allow the LLM to make tool use calls!
But GitHub has fine-grained access tokens, so you can generate one scoped to just the repo that you're working with, and which can only access the resources it needs to. So if you use a credential like that, then the LLM can only be tricked so far. This attack wouldn't work in that case. The attack relies on the LLM having global access to your GitHub account, which is a dangerous credential to generate anyway, let alone give to Claude!
I think that's probably something anybody using these tools should always think. When you give a credential to an LLM, consider that it can do up to whatever that credential is allowed to do, especially if you auto-allow the LLM to make tool use calls!
But GitHub has fine-grained access tokens, so you can generate one scoped to just the repo that you're working with, and which can only access the resources it needs to. So if you use a credential like that, then the LLM can only be tricked so far. This attack wouldn't work in that case. The attack relies on the LLM having global access to your GitHub account, which is a dangerous credential to generate anyway, let alone give to Claude!