Incorrect user attribution in a task suggestion involving the GitHub MCP integration #3504

Description

While using ChatGPT with the GitHub MCP integration, I received an automatic suggestion to review [growthbook/growthbook#7309](growthbook/growthbook#7309), a repository I do not recognize as related to my work.

The suggestion claimed that I had already replied “Fixed.” to a review comment at 19:38 UTC. However, verification through the GitHub MCP tools showed that the comment was written by a different account.

Verified evidence

• My authenticated GitHub account: williambelini-maker.
• Actual author of “Fixed.”: allileong, the PR author.
• Comment timestamp: October 14, 2026, at 19:38:16 UTC.
• Comment: Populations Create/Edit and Detail pages growthbook/growthbook#7309 (comment)
• Original review comment: Populations Create/Edit and Detail pages growthbook/growthbook#7309 (comment)

The reply addressed a Cursor bot review requesting that a description be truncated to 80 characters. It was not posted by my authenticated account.

Actual behavior

The automatically suggested task presented another user's activity as my own and instructed the assistant to continue work on that PR.

The assistant began reading the repository through the GitHub MCP integration before I clarified that I did not recognize the task. No code changes or comments were submitted.

Expected behavior

• Verify account identity before attributing GitHub activity to the user.
• Explain why a repository or PR is relevant to a personalized suggestion.
• Avoid presenting another account's comments as the authenticated user's history.

Investigation requested

Please investigate why this PR was suggested to my session and why activity by allileong was attributed to williambelini-maker.

The incorrect attribution is confirmed. Its technical origin is unknown: I cannot determine whether it originated in suggestion generation, context handling, or the GitHub MCP integration. This report does not establish a data leak or cross-account access.