- An attacker could exploit Git server vulnerabilities.
- No crypto impact or asset movement reported.
- Security experts recommend immediate patch updates.
Cyata Security researchers discovered and disclosed three high-risk vulnerabilities in Anthropic’s MCP Git server, leading to patches for arbitrary file access and remote code execution. These fixes occurred quietly without public acknowledgment from Anthropic’s leadership.
Anthropic has rectified three high-risk vulnerabilities in its MCP Git server, initially disclosed by Cyata Security researchers in 2025. Despite the fix, no responses have been received from Anthropic’s leadership on this matter.
Experts highlight the significance of Anthropic’s patch, correcting vulnerabilities without affecting cryptocurrency markets or financial sectors.
Anthropic corrected multiple security vulnerabilities in its MCP Git server. The issues were discovered by Cyata Security and patched by December 2025. These vulnerabilities included arbitrary file access and remote code execution risks.
The vulnerabilities, tracked as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145, were identified by Cyata. No cryptocurrency was affected despite potential risks, and no direct public acknowledgment from Anthropic followed the patching.
Experts conveyed no financial repercussions on crypto markets.
However, the vulnerabilities highlight critical security considerations for digital infrastructures. Shahar Tal, Cyata CEO, emphasized the need for enhanced security measures across the board.
Potential outcomes indicate the vulnerabilities serve as a wake-up call on digital security frameworks. Yarden Porat, researcher at Cyata, stressed that organizations must anticipate more complex system interactions to mitigate risks effectively, reinforcing the industry’s ongoing examination of security vulnerabilities.
“These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README, a poisoned issue description, a compromised webpage) can weaponize these vulnerabilities without any direct access to the victim’s system.” — Yarden Porat, Researcher, Cyata Security
Wake-Up Call for Digital Security: Anthropic’s Git Server Issues
