Encrypted instructions trick Copilot CLI into spilling developer secrets
GitHub Copilot CLI can be made to read sensitive files from a developer’s machine and send their contents to an attacker from a single web page. Security researchers at Adversa AI said the new attack technique, dubbed Cryptographic Context Injection (CCI), hides malicious instructions inside encrypted content.
GitHub Copilot CLI can be made to read sensitive files from a developer’s machine and send their contents to an attacker from a single web page. Security researchers at Adversa AI said the new attack technique, dubbed Cryptographic Context Injection (CCI), hides malicious instructions inside encrypted content.
In a demonstration, Adversa researchers got Copilot to read a “.env.prod” file containing secrets and send its contents to an attacker-controlled endpoint. “Full chain: 28 seconds, no confirmation, and no point in the transcript that names the destination host or indicates that file contents left the machine,” the researcher said in a blog post.
According to Adversa, the attack is not a universal one-click compromise as it requires Copilot CLI to be running in autopilot mode and a model willing to execute the decrypted instructions. GitHub has validated the finding but declined to treat it as a vulnerability, saying the user had explicitly asked Copilot to fetch attacker-controlled content while giving full permissions to act autonomously.
“They noted they may make the functionality stricter in the future but had nothing to announce, and ruled the report ineligible for the GitHub bug bounty program,” Adversa said. The researchers disputed that assessment, arguing that it does not explain why Copilot rejects the same instructions when presented in plaintext but accepts them after they have been encrypted and decrypted within its execution environment.
GitHub did not immediately respond to CSO’s request for comment.
An attack could begin with a user running Copilot CLI and asking it to fetch a URL, the researchers explained. The page would contain encrypted instructions that the agent would then be asked to decrypt using two candidate keys.
In context
- Topic: Desarrollo con IA — Copilotos y agentes en el ciclo de desarrollo de software.
- Source: InfoWorld
- Published: 07/10/2026
Continue reading at the original source →
Excerpt published automatically by the site radar. The full text belongs to its publisher and is linked above.
Why it matters
What is changing in engineering is not typing speed, it is the relationship between whoever produces and whoever answers for the result. An assistant can generate in minutes something nobody on the team fully understands, and that carries a cost that shows up in no productivity metric.
I look at it from operations, not from the demo. The question is not whether the assistant writes a correct function, but whether the team can maintain what it produced six months later, with different people, without the original context. That is the real test and it almost never appears in the announcements.
What usually goes wrong
The problem appears when somebody accepts code they do not fully understand but which passes the tests. It works, it ships, and six months later it needs changing. That is when you discover nobody on the team can explain why it is written that way, and the small change becomes a rewrite.
What to watch
- The effect on people newly joining the team, which is where judgement erodes fastest.
- Whether total time to production drops or only writing time, which is not the same thing.
- What happens to code review: if the assistant produces more, somebody has to read more.
How I read this entry
I would treat it as a process change, not a tool change. The assistant shifts who does what inside the team, and that has to be discussed with people beforehand, not discovered in the retrospective once somebody already felt replaced.
This entry is an excerpt from the original source, selected by the site radar. The commentary above is the site's own and does not belong to the cited publisher.
Comments
No comments yet. Yours can be the first.
Living through this in your own team?
Open the chat and tell me how you're handling it. I'm interested in comparing notes.
