Cybersecurity researchers at Adversa AI have discovered a critical vulnerability in GitHub Copilot CLI. Under certain conditions, the tool could be forced to steal and send private keys, passwords, and configuration files (e.g., .env) to attackers.
Cybersecurity researchers at Adversa AI have discovered a critical vulnerability in GitHub Copilot CLI. Under certain conditions, the tool could be forced to steal and send private keys, passwords, and configuration files (e.g., .env) to attackers.
The attack is based on the Cryptographic Context Injection (CCI) method, the same one found in the Grok neural network two months earlier, The Register reports .
The threat is implemented when a developer runs Copilot CLI in autopilot mode and asks the tool to read the content of a specific web page.
The attacker places instructions on the site encrypted with a strong cipher. Standard security filters and classifiers do not see the encrypted text as a threat (unlike simple encoding types like Base64).
The AI agent is instructed to decrypt the text using Python. The first decryption key is a fake one. The instruction forces the AI to generate this key by pulling data from the developer's local files (e.g., secrets from .env). The attempt to decrypt with this "key" fails.
The AI takes the second (real) key, successfully decrypts the text, and receives a new command — to go to the next URL to “get context.” However, this URL already contains a generated string with stolen secrets, which are automatically sent to the hacker’s server when requested.
The success of the attack depends on which model Copilot CLI uses in a particular session:
mai-code-1.1-flash (Microsoft's own model) - proved to be vulnerable and successfully executed the entire attack chain in 50% of cases;
OpenAI GPT-5.6 (two modifications) - proved to be stable and refused to execute malicious commands.
Researchers note that if the model selection in the account settings is set to "Auto", the developer does not even know which model is processing his request at that moment, which turns the work into a real lottery.
The Adversa AI team reported the issue to GitHub via the Bug Bounty program on September 17, 2026. GitHub specialists confirmed the reproduction of the issue, but refused to recognize it as a system vulnerability.
A GitHub representative stated: “This requires the user to knowingly direct the Copilot CLI to download maliciously controlled or untrusted content and confirm this action. So, this is not a vulnerability in the product itself. However, we are always looking for ways to improve protection.”
Adversa AI disagrees with this assessment and warns: since GitHub refused to release a patch, the attack remains fully operational for all users who run the tool in autopilot mode.
