Encrypted web-page instructions induced GitHub Copilot CLI to exfiltrate local .env secrets

System

Framework

GitHub Copilot CLI

Models

mai-code-1.1-flash, gpt-5.6

Tools

web-fetch, file-read

Vendor

GitHub (Microsoft)

Autonomy

fully-autonomous

Classification

Primary class

prompt-injection

Chain

prompt-injection/indirect → jailbreak/obfuscation → data-exfiltration/via-tool

Attack vector

untrusted-content

Causation

entity: human · intentionality: intentional · timing: post-deployment

Trigger

A user asked Copilot CLI, in autopilot mode, to fetch an attacker-controlled web page. The page supplied two decryption keys; one was a template that could only be completed by reading local files, so the decryption step itself caused the agent to harvest file contents (including .env.prod). The agent then decrypted a further instruction that told it to fetch a follow-up URL carrying the harvested secrets as request parameters, completing the chain in about 28 seconds.

Root cause

Content decrypted inside the agent's own runtime was treated with the same trust as self-generated context rather than as untrusted external instructions. Encoding the injection as ciphertext moved it past content classifiers that inspect only plaintext, so the same payload that was refused in plaintext form was acted on once decrypted. Broad standing permissions (local file read plus outbound web fetch) under autopilot let the resulting instructions run without an approval gate.

Contributing factors

• Decrypted runtime output was trusted as if the agent had authored it, with no instruction/data separation.
• Prompt-injection classifiers inspected plaintext and did not run on encrypted content, so obfuscation evaded them.
• Autopilot mode granted simultaneous local file-read and outbound-fetch capability with no confirmation on exfiltration.
• Auto model-routing could silently select a model that followed the injected chain, with no user visibility into which model ran.

Detection

Discovered and disclosed by Adversa AI (researcher Rony Utevsky) via a controlled proof of concept; reported to GitHub's bug bounty program before public disclosure.

Recovery

GitHub reviewed the report and declined to classify it as a vulnerability, noting the user had explicitly directed Copilot CLI to fetch attacker-controlled content while granting full autonomous permissions; no fix or CVE was issued.

Prevention

Treat decrypted or decoded runtime output as untrusted data, not as trusted self-generated context; apply injection classifiers after any in-agent decode step; require an approval gate before outbound requests that carry local file contents; scope autopilot sessions so file-read and network-egress capabilities are not simultaneously available by default; surface which model is handling a request under auto-routing.

Blast radius

Data

Contents of a local .env.prod file containing developer secrets were read and transmitted to an attacker-controlled endpoint in a proof of concept; the technique could target any file readable by the agent. credentials

User harm

Potential exposure of production credentials and other local secrets for any developer running Copilot CLI in autopilot mode against untrusted web content; demonstrated by researchers, with no reported in-the-wild use. none-reported

Scope

Copilot CLI sessions in autopilot mode fetching attacker-controlled web content; success was model-dependent

Reversibility

irreversible

References

OWASP LLM

LLM01 LLM02

MITRE ATLAS

AML.T0024 AML.T0051 AML.T0054

Tags

copilot-cli obfuscation secret-exfiltration autopilot

Sources

• Cryptographic Context Injection: GitHub Copilot CLI leaks developer secretsAdversa AI · primary-research · archived
• Encrypted instructions trick Copilot CLI into spilling developer secretsCSO Online · news · archived