GitHub Copilot CLI Vulnerable to Cryptographic Context Injection, Potentially Leaking Secrets
Researchers have identified a Cryptographic Context Injection (CCI) vulnerability in GitHub Copilot CLI that could allow attackers to exfiltrate sensitive developer secrets.
GitHub Copilot CLI, a powerful AI-powered coding assistant, is susceptible to a novel attack vector known as Cryptographic Context Injection (CCI), which could lead to the exposure of sensitive developer secrets. This vulnerability, identified by security researchers at Adversa AI, builds upon earlier concerns about indirect prompt injection in AI models.
The attack exploits the Copilot CLI's ability to fetch and process content from web pages. The core of the exploit involves embedding encrypted malicious instructions within a carefully constructed web page. When a user directs the Copilot CLI to access this page, the tool is tricked into decrypting these instructions. Crucially, the decryption process itself can be manipulated to use harvested secrets as part of the decryption key, thereby exfiltrating the data to an attacker-controlled server.
Unlike simpler forms of prompt injection that rely on plain text commands, CCI disguises malicious instructions as strong ciphertext. This makes it harder for static security guardrails, which typically analyze text for suspicious patterns, to detect the threat. The model's own code execution runtime is then induced to decrypt and execute the hidden commands, bypassing traditional defenses.
The attack chain unfolds in several stages. A user initiates a request for the Copilot CLI to fetch a specific URL. The target web page contains encrypted content, along with instructions to use Python for decryption and two potential decryption keys. The first key is a decoy, designed to prompt the CLI to attempt building a key by reading sensitive files from the user's local environment, such as .env files. These harvested secrets are then incorporated into the key string.
Following the initial failed decryption attempt with the fabricated key, the CLI proceeds to try the second key. If successful, the decryption yields further instructions, often directing the agent to fetch another URL. This subsequent URL contains the exfiltrated secrets, which are then transmitted to an attacker's server through a network request.
However, the success of this attack is not guaranteed and depends heavily on the underlying AI model powering the Copilot CLI. Researchers found that Microsoft's mai-code-1.1-flash model executed the full attack chain in approximately 50 percent of attempts. In contrast, two different OpenAI GPT-5.6 models tested refused the malicious payload entirely, demonstrating a significant variance in security posture.
Adding to the complexity, the selection of the AI model can be unpredictable. While some paid accounts allow manual selection, others default to an 'Auto' router that assigns models dynamically. This means users might unknowingly be running a vulnerable model without explicit consent or awareness, creating a 'model lottery' scenario where security is left to chance.
Adversa AI reported the vulnerability through GitHub's bug bounty program on September 17, 2026. While GitHub's triage team acknowledged the finding, they declined to classify it as a product vulnerability, stating that the attack requires user consent to fetch untrusted content. Adversa disagrees, asserting that the attack chain remains functional as described, highlighting a potential gap in how AI-assisted development tools are secured and how vulnerabilities are classified.