Wiz finds a critical GitHub RCE with Claude Code and IDA MCP

AI-augmented reverse-engineering tooling used by Wiz Research: Claude Code (named by The Register and WebProNews) with IDA MCP for automated reverse engineering of GitHub's compiled binaries (named by Wiz), applied to GitHub.com's backend and GitHub Enterprise Server 3.19.1

Not assessed

Exact release not established.

Anthropic (Claude Code); the maker of IDA MCP is not named in the sources

The tools analyzed compiled binaries and helped researchers reconstruct internal protocols.

Wiz used IDA MCP to analyze GitHub’s compiled binaries. The Register identified Claude Code as the tool through which researchers performed some of that work.

Editor’s note. Wiz’s original report names IDA MCP but not Claude Code. The latter identification comes from The Register’s reporting (references 4 and 5).

The tools analyzed compiled binaries and helped researchers reconstruct internal protocols.

Not assessed

Wiz researchers obtained GitHub’s compiled software that also shipped with Enterprise Server. They used AI tools to examine it and developed an exploit that they confirmed on version 3.19.1. Their report showed that remote code execution was possible. GitHub reproduced the issue within 40 minutes and fixed github.com that evening.

Wiz researchers developed and tested the exploit. GitHub’s security and engineering teams reproduced the vulnerability and deployed the fix.

The AI's documented contribution is speed of analysis, on the researchers' own account. Wiz writes that AI-augmented reverse-engineering tooling, particularly IDA MCP, let it rapidly analyze GitHub's compiled binaries and reconstruct internal protocols. Wiz says that speed would not have been feasible manually. Sagi Tzadik told Dark Reading that with AI tools it took under 48 hours from idea to working exploit. The Register adds that the team used Claude Code “to take a lot of the legwork out of the process”. The hypothesis, the exploit, the report and the fix were human work. Six named Wiz researchers confirmed RCE on GHES 3.19.1 and wrote what GitHub called a thorough report. GitHub's security and engineering teams reproduced the bug within 40 minutes and deployed the fix. GitHub's own post, the CVE record and the GHES release notes describe a Bug Bounty report without mentioning AI. The AI-assistance claim therefore rests on Wiz and on outlets quoting Wiz. Wiz's write-up, in the text as read, names IDA MCP and not Claude.

Wiz researchers used AI tools to analyze GitHub’s compiled software and reconstruct its internal protocols. They reported that the tools accelerated the work and that they produced a working exploit in under 48 hours.

Not assessed

GitHub fixed a vulnerability that allowed remote code execution after Wiz researchers reported it.

Reduced Risk

Not assessed

Organizations.

GitHub and organizations using GitHub Enterprise Server.

Not assessed

Not assessed

Not assessed

Yes

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Time from the initial idea to a working exploit, time to verify the report, and time to deploy a fix.

Assumed alternative: manual reverse engineering of GitHub's compiled binaries without AI tooling

Wiz reports less than 48 hours from the initial idea to a working exploit. Its comparison with months of manual analysis is an estimate, without a measured control.

Not assessed

The account of AI assistance comes from Wiz and interviews with its researchers. Wiz names IDA MCP; The Register and WebProNews name Claude Code. GitHub independently confirmed and fixed the vulnerability but did not describe AI’s contribution.

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Developer: Anthropic (Claude Code); the maker of IDA MCP is not named in the sources. Operator: Wiz Research (Sagi Tzadik, Nir Ohfeld, Ronen Shustin, Hillai Ben-Sasson, Yuval Avrahami, Noam Malron).

Developer: United States. Operator: United States.

Not assessed

Not assessed

Not assessed

Not assessed

Researchers need access to the compiled software and an environment for testing the suspected flaw. They must establish that the exploit works, report it privately, and allow time for patches. Self-hosted customers need to install the patched release.

Not assessed

GitHub fixed github.com on 4 March 2026 and released Enterprise Server patches from 10 March. Public disclosure followed on 28 April, with an investigation that found no exploitation beyond the researchers’ testing.

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

AIBD-0206-source-0001–0009

Numbered references below.

Not assessed

Beneficiary, Operator, Independent, Developer

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Not assessed

Organizations.

Organizations: 2.

GitHub closed the vulnerability within hours and patched six Enterprise Server release lines. Its investigation found that no other account had triggered the affected code path and that no customer data had been accessed, changed, or removed. The benefit is a corrected exposure, with no measured loss avoided.

Not assessed

Not assessed

Not assessed

Not assessed

Independently reported

Not assessed

Not assessed

Cybersecurity: vulnerability research and software supply chain. Bug bounty research: AI-assisted reverse engineering of closed-source server binaries.

Claude Code is Anthropic's agentic coding tool, built to read a codebase, edit files, run commands and connect to external tools over MCP. Wiz used it, with IDA MCP, to automate reverse engineering of GitHub's compiled binaries. Analyzing code for flaws is within that general purpose. The benefit was an application of what the tool was built to do rather than a departure from it.

Date basis unassessed: 2026 (precision unassessed). Updated: 25 October 2026.

Not assessed

SHA-256: 7f34bca5fb89…

oecd_aim: 2026-04-28-f5d8.

Not assessed

Not assessed

7 revisions. Latest: 25 October 2026.