GitHub Copilot CLI Vulnerability Exposes Developer Secrets via Encrypted Prompts
On October 6, 2026, Adversa AI researchers revealed a Cryptographic Context Injection (CCI) attack targeting GitHub Copilot CLI, enabling threat actors to extract sensitive developer secrets such as .env.prod files through encrypted instructions. The technique exploits the tool’s trust in decrypted runtime output, bypassing plaintext prompt injection defenses.
The attack begins when a developer instructs Copilot CLI to fetch an external webpage containing encrypted content. The page provides two decryption keys: one legitimate and one templated to require local file data. Copilot CLI reads targeted files (including those outside the working directory) to populate the templated key before attempting decryption. A deliberate failure with the first key triggers the agent to use the legitimate one, revealing a second-stage instruction that directs Copilot to send the collected file contents to an attacker-controlled URL all within 28 seconds in the demonstration.
The attack requires autopilot mode and a permissive model, such as Microsoft’s mai-code-1.1-flash, which executed the payload in 50% of tests. In contrast, two GPT-5.6 models consistently rejected the same payload. Vulnerability varied by account: while one paid account allowed manual selection of a susceptible model, another using Auto routing received both vulnerable and resistant models across sessions, creating inconsistent protection.
Notably, the attack leaves no visible trace in the transcript of the destination host or file exfiltration. Adversa AI reported the issue to GitHub’s bug bounty program on September 17, 2026, but GitHub declined to classify it as a vulnerability, citing the user’s explicit request for attacker-controlled content and autonomous permissions. The exploit remained reproducible as of October 1, 2026, though specific payloads were withheld.
Researchers emphasized that model refusals alone are insufficient and recommended additional controls, including monitoring for webpage retrievals, code execution, local file access, and unexpected outbound connections, as well as restricting new destinations and isolating untrusted content from credential-holding contexts.
Source: https://cyberpress.org/github-copilot-cli-flaw/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
GitHub TPRM report: https://www.rankiteo.com/company/github
"id": "micgit1791397527",
"linkid": "microsoft-security, github",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Developers using GitHub Copilot '
'CLI in autopilot mode with '
'permissive models',
'industry': 'Software Development Tools',
'location': 'Global',
'name': 'GitHub (Microsoft)',
'size': 'Large (subsidiary of Microsoft)',
'type': 'Technology / Software Development'}],
'attack_vector': 'Encrypted Prompt Injection (Cryptographic Context '
'Injection)',
'data_breach': {'data_encryption': 'No (data was exfiltrated in plaintext '
'after decryption)',
'data_exfiltration': 'Yes (to attacker-controlled URL)',
'file_types_exposed': ['.env.prod',
'Local files (unspecified types)'],
'personally_identifiable_information': 'Potential (if .env '
'files contained PII '
'or credentials)',
'sensitivity_of_data': 'High (developer secrets, potentially '
'PII or credentials)',
'type_of_data_compromised': ['Environment variables '
'(.env.prod)',
'Local files outside working '
'directory']},
'date_detected': '2026-09-17',
'date_publicly_disclosed': '2026-10-06',
'description': 'Adversa AI researchers revealed a Cryptographic Context '
'Injection (CCI) attack targeting GitHub Copilot CLI, enabling '
'threat actors to extract sensitive developer secrets such as '
'.env.prod files through encrypted instructions. The technique '
'exploits the tool’s trust in decrypted runtime output, '
'bypassing plaintext prompt injection defenses.',
'impact': {'brand_reputation_impact': 'Potential erosion of trust in GitHub '
'Copilot CLI security',
'data_compromised': 'Sensitive developer secrets (e.g., .env.prod '
'files, local files outside working directory)',
'identity_theft_risk': 'High (if PII or credentials were exposed)',
'operational_impact': 'Potential unauthorized access to sensitive '
'files and exfiltration to '
'attacker-controlled URLs',
'payment_information_risk': 'High (if payment-related secrets were '
'exposed)',
'systems_affected': 'GitHub Copilot CLI (autopilot mode with '
'permissive models)'},
'initial_access_broker': {'entry_point': 'Encrypted instructions in external '
'webpage fetched by Copilot CLI',
'high_value_targets': 'Developer secrets (.env.prod '
'files, local files)'},
'investigation_status': 'Reported to GitHub bug bounty program; not '
'classified as a vulnerability by GitHub',
'lessons_learned': 'Model refusals alone are insufficient for security; '
'additional controls are needed for monitoring and '
'restricting untrusted content interactions. Permissive '
'models (e.g., mai-code-1.1-flash) pose higher risks. '
'Attacks can occur rapidly (28 seconds) and leave no '
'visible trace in transcripts.',
'motivation': 'Security Research / Vulnerability Demonstration',
'post_incident_analysis': {'corrective_actions': ['Implement monitoring for '
'suspicious activities '
'(e.g., local file access, '
'outbound connections)',
'Restrict autopilot mode '
'for permissive models',
'Improve model routing '
'consistency',
'Isolate untrusted content '
'from sensitive contexts'],
'root_causes': ['Trust in decrypted runtime output '
'without sufficient validation',
'Permissive model behavior (e.g., '
'mai-code-1.1-flash)',
'Lack of monitoring for local file '
'access and outbound connections',
'Inconsistent model routing '
'leading to variable protection']},
'recommendations': ['Monitor for webpage retrievals, code execution, local '
'file access, and unexpected outbound connections',
'Restrict new destinations for outbound connections',
'Isolate untrusted content from credential-holding '
'contexts',
'Avoid using permissive models in autopilot mode',
'Implement stricter model routing controls to prevent '
'inconsistent protection'],
'references': [{'date_accessed': '2026-10-06',
'source': 'Adversa AI Research'}],
'response': {'communication_strategy': 'Public disclosure by Adversa AI; '
'GitHub declined to classify as a '
'vulnerability',
'enhanced_monitoring': 'Recommended: Monitor for webpage '
'retrievals, code execution, local file '
'access, and unexpected outbound '
'connections'},
'threat_actor': 'Adversa AI (researchers, not malicious)',
'title': 'GitHub Copilot CLI Vulnerability Exposes Developer Secrets via '
'Encrypted Prompts',
'type': 'Data Exfiltration',
'vulnerability_exploited': 'Trust in decrypted runtime output, permissive '
'model behavior (e.g., mai-code-1.1-flash)'}