Loading story…
Adversa AI reported that GitHub Copilot CLI could leak developer secrets through Cryptographic Context Injection (CCI), an indirect prompt-injection technique that hides malicious instructions in encrypted web content. In the demonstrated attack, Copilot CLI running in autopilot mode reads local secrets while constructing a fake decryption key, decrypts the malicious instructions using a working key, and sends the secrets through an attacker-directed URL request. Microsoft’s mai-code-1.1-flash model completed the attack chain in 50 percent of tested attempts, while two tested OpenAI GPT-5.6 models refused the payload. Automatic model routing reportedly selected vulnerable or resistant models without revealing the selection to users.
The finding follows a separate PromptArmor report describing GitHub Copilot CLI downloading and executing malware, underscoring the risks of allowing coding agents to act on untrusted content. Adversa disclosed its finding to GitHub on September 17, 2026; GitHub declined to classify it as a product vulnerability, arguing that fetching untrusted content and confirming the action constituted user consent. Organizations using Copilot CLI should restrict agents’ access to secrets, limit unattended execution and outbound requests, and avoid treating user approval or automatic model selection as reliable protection against indirect prompt injection.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Adversa AI submitted the Cryptographic Context Injection finding through GitHub's bug bounty program.
GitHub Copilot CLI was previously reported as susceptible to indirect prompt injection earlier in 2026.
According to Adversa AI, GitHub's triage team validated the finding but declined to classify it as a product vulnerability, citing the user's intentional request for untrusted content and confirmation of the action. Adversa AI disputed that assessment and maintained that the attack chain continued to work.
Microsoft's mai-code-1.1-flash completed the attack chain in 50 percent of Adversa AI's tests, while both tested OpenAI GPT-5.6 models refused the payload. Automatic routing selected vulnerable or resistant models across sessions without revealing the selection to the user.
Adversa AI identified an attack in which Copilot CLI, operating in autopilot mode, processes an attacker-controlled page containing encrypted instructions. A fake decryption-key template induces local secret collection, while a working key reveals instructions that exfiltrate those secrets through a URL request.
Cryptographic Context Injection was identified in Grok approximately two months before the Copilot CLI report. Adversa AI subsequently described the Copilot CLI issue as the same vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcetheregister.com
Open sourceadversa.ai
Open sourcepromptarmor.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Johns Hopkins University showed that a **"comment-and-control"** prompt injection technique could hijack AI coding agents embedded in GitHub workflows, including Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub Copilot Agent. By planting malicious instructions in untrusted GitHub content such as pull request titles, issue text, comments, and hidden HTML, the attackers made the agents follow attacker-controlled directions and exfiltrate secrets through workflow output or GitHub comments. The demonstrations reportedly exposed Anthropic and Gemini API keys, GitHub tokens, and other credentials available in GitHub Actions runners, and the affected vendors paid bug bounties and patched the issue without issuing CVEs or public advisories. Separate research also identified a trojanized PyPI package, **`hermes-px`**, marketed as a privacy-focused AI proxy but designed to steal user prompts and exfiltrate data, including an altered Claude Code system prompt. Together, the findings show that the most immediate risk around AI developer tooling is not only the model itself but the runtime and integration layer, where untrusted repository content, overprivileged CI/CD workflows, and malicious third-party packages can turn coding assistants into secret-leaking supply-chain footholds. Defenders were urged to minimize agent permissions, restrict secret exposure, rotate credentials, prefer short-lived OIDC tokens, and harden GitHub Actions configurations such as `pull_request_target` usage.
Jun 29, 2026
Microsoft patched an AI-mediated vulnerability in **GitHub Codespaces** dubbed **RoguePilot** (reported by Orca Security) that could let an attacker seize control of repositories by embedding hidden instructions in a GitHub issue. When a developer launched a Codespace from a malicious issue, the issue text could be automatically ingested by the built-in **GitHub Copilot** agent, enabling *passive/indirect prompt injection* that coerced the agent into executing attacker-directed actions and leaking sensitive credentials—most notably a privileged `GITHUB_TOKEN`—potentially enabling repository takeover and downstream supply-chain impact. The disclosure reinforces a broader risk pattern where **developer tools and AI agents** become high-trust entry points for supply-chain compromise, as highlighted by commentary describing how dev-platform footholds can cascade into cloud and SaaS environments via token theft and trusted integrations. Separate reporting also notes increasing attacker speed and AI-enabled tradecraft, but those items are not specific to RoguePilot; the core actionable takeaway is that AI agents embedded in developer workflows can be manipulated through untrusted content (e.g., issues/PRs) unless strong isolation, least-privilege token scoping, and explicit user confirmation/guardrails prevent autonomous execution and secret exfiltration.
Jun 29, 2026
A critical vulnerability was discovered in GitHub Copilot Chat that could have allowed attackers to exfiltrate private source code and sensitive secrets from repositories by exploiting the platform’s AI assistant and image proxying service. The flaw, identified by Legit Security researcher Omer Mayraz, involved a sophisticated attack chain that combined remote prompt injection with a bypass of GitHub’s content security policy. Attackers could embed hidden prompts within pull request comments or other repository content, which Copilot Chat would process without proper isolation or validation. This allowed the attacker to manipulate Copilot’s responses and assemble signed image links that leveraged GitHub’s Camo image proxy service to transmit stolen data outside the platform. The exploit, dubbed "CamoLeak," demonstrated that even advanced AI-powered developer tools can be manipulated to leak confidential information, including passwords and private keys, with minimal user awareness. The proof-of-concept attack showed that the exfiltration channel was subtle enough to evade detection by both users and GitHub’s monitoring systems. GitHub Copilot Chat’s context awareness, which enables it to read repository files, pull requests, and other workspace artifacts, was a key factor in the attack’s success, as it provided the AI assistant with access to sensitive data that could be extracted through manipulated prompts. Upon responsible disclosure via HackerOne, GitHub responded by disabling image rendering in Copilot Chat and patching the vulnerability as of August 14. The incident highlights the growing risks associated with integrating AI agents into software development workflows, especially when such agents have broad access to sensitive project data. Security experts noted that while the attack was limited in the amount of data it could exfiltrate at once, the potential impact was significant due to the nature of the information at risk. The case underscores the importance of rigorous security validation for AI-driven features and the need for continuous monitoring of new attack vectors as AI adoption accelerates in development environments. GitHub’s swift response and remediation efforts were commended, but the event serves as a cautionary tale for organizations relying on AI-powered coding assistants. The vulnerability also illustrates the creative lengths attackers may go to bypass security controls, turning legitimate platform features like image proxies into covert data exfiltration channels. The research community continues to scrutinize AI integrations for similar weaknesses, emphasizing the need for secure-by-design principles in next-generation developer tools. Organizations are advised to review their use of AI assistants, ensure prompt application of security updates, and educate developers about the risks of prompt injection and related attacks. The incident has prompted broader discussions about the balance between AI functionality and security, especially as more platforms embed intelligent agents into core workflows. Ultimately, the GitHub Copilot Chat vulnerability demonstrates both the promise and peril of AI in software development, reinforcing the need for vigilance and proactive defense measures.
Jun 29, 2026