The issue here (which is almost always the case with prompt injection attacks) is that an LLM has access to attacker-controlled data, sensitive information, and a data exfiltration capability.
THe "cardinal rule of agent design" should be that an LLM can have access to at most two of these during one session. To avoid security issues, agents should be designed in a way that ensures this.
For example, any agent that accesses an issue created by an untrusted party should be considered "poisoned" by attacker-controlled data. If it then accesses any private information, its internet access capability should be severely restricted or disabled altogether until context is cleared.
In this model, you don't need per-repo tokens. As long as the "cardinal rule" is followed, no security issue is possible.
Sadly, it seems like MCP doesn't provide the tools needed to ensure this.
THe "cardinal rule of agent design" should be that an LLM can have access to at most two of these during one session. To avoid security issues, agents should be designed in a way that ensures this.
For example, any agent that accesses an issue created by an untrusted party should be considered "poisoned" by attacker-controlled data. If it then accesses any private information, its internet access capability should be severely restricted or disabled altogether until context is cleared.
In this model, you don't need per-repo tokens. As long as the "cardinal rule" is followed, no security issue is possible.
Sadly, it seems like MCP doesn't provide the tools needed to ensure this.