Adversa AI researchers discovered that GitHub Copilot CLI can be tricked into leaking credentials through what they call Cryptographic Context Injection: encrypted instructions embedded on a web page, hidden from content filters. When a user fetches the URL in autopilot mode, the tool attempts decryption using a decoy key that forces it to read local files like .env.prod as a side effect, exfiltrating secrets in the process.
The clever bit is the encryption layer. Traditional prompt injection defenses can’t filter what they can’t see. But what’s worth reacting to is what happens next: success rates hinge on which model underpins the tool. Microsoft’s mai-code-1.1-flash executed the full attack chain roughly 50% of the time. OpenAI’s models refused outright. That’s a lottery, not a design principle.
GitHub validated the research in September 2026 but declined to classify it as a vulnerability, arguing that fetching untrusted content constitutes implicit user consent to whatever follows. Adversa disputes this framing. The question is whether intent to fetch = intent to be exploited, and the answer probably tracks closer to “no” than GitHub’s position suggests.
Sources: Adversa AI
Coverage: The Register
Related on this blog: [AUTO] Snowflake Actions Flaw Reveals AI Review Gap • [AUTO] MemTensor Worm Exploits GitHub Actions Token Interception • One Word Beat GitHub’s Guardrail, and the Word Was ‘Additionally’