Read-merge-write replacement had no per-field concurrency precondition. Entry and authority. Two authorized agents edit separate project fields at overlapping times. Observed mechanism and consequence. The issue reports 19 lost changes in 30 concurrent pairs, compared with zero in 28 per-field GraphQL controls; pagination may also truncate source state. L…
Inspect the ClaimsCase · DiggingBeagle record
GitHub MCP issue field edits lost concurrent updates
Read-merge-write replacement had no per-field concurrency precondition.
Public disclosure: Nov 9, 2026
Scope
Two authorized agents edit separate project fields at overlapping times. The issue reports 19 lost changes in 30 concurrent pairs, compared with zero in 28 per-field GraphQL controls; pagination may also truncate source state.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- none known
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITHUB-MCP-LOST-UPDATE; reviewed as research in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITHUB-MCP-LOST-UPDATE-01 · CLM-ENR234-DB233-GITHUB-MCP-LOST-UPDATE · github-mcp-server issue #3751
At a glance
Issue-level benchmark, not a measured production-wide loss rate.
Limits and uncertaintyFull account
Read-merge-write replacement had no per-field concurrency precondition.
Entry and authority. Two authorized agents edit separate project fields at overlapping times.
Observed mechanism and consequence. The issue reports 19 lost changes in 30 concurrent pairs, compared with zero in 28 per-field GraphQL controls; pagination may also truncate source state.
Limits and status. Issue-level benchmark, not a measured production-wide loss rate.
The issue-field update path read a collection of values, changed one field locally and submitted the entire collection. Two agents updating independent fields could therefore overwrite one another between the read and the write. The reported experiments measured 19 lost updates among 30 concurrent pairs; a per-field GraphQL operation avoided loss in the comparison. This is a concurrency correctness failure with potential security-policy consequences, not evidence of attacker-controlled access.
Mechanism and trust boundary
- 01
Precondition and trust context
Two authorized agents edit separate project fields at overlapping times.
- 02
Crossed boundary
The issue reports 19 lost changes in 30 concurrent pairs, compared with zero in 28 per-field GraphQL controls; pagination may also truncate source state.
- 03
Observed limit
Issue-level benchmark, not a measured production-wide loss rate.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
GitHub MCP issue field edits lost concurrent updates
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITHUB-MCP-LOST-UPDATE-01A repository issue reports: The issue reports 19 lost changes in 30 concurrent pairs, compared with zero in 28 per-field GraphQL controls; pagination may also truncate source state.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3751primary disclosure
Issue #3751, description and reproduction
CLM-ENR234-DB233-GITHUB-MCP-LOST-UPDATEThe reporter measured 19 lost edits in 30 paired concurrent GitHub MCP issue-field updates, compared with none in 28 direct per-field GraphQL controls.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3751primary disclosure
Issue #3751, paired-write reproduction and comparison against setIssueFieldValue
Controls and mitigations
- Use field-scoped atomic mutations or compare-and-swap preconditions, with retry on version conflicts.
- Test concurrent agent writers and pagination beyond the first returned batch of project fields; return authoritative post-write values.
Unknowns and contradictions
- Issue-level benchmark, not a measured production-wide loss rate.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235