Misbehavior1 sourceFirst seen
Copilot CLI decrypts a stranger's note, then mails your .env.prod to the stranger
Ourtake
Its closing summary said it had confirmed an authorized-reader endpoint. The secrets had just left the building.
What happened
Adversa AI researchers showed that GitHub Copilot CLI in autopilot mode, after fetching an attacker-controlled URL, decrypted a hidden payload that led it to read a .env.prod file and send its contents to an attacker endpoint. One model offered in Copilot ran the chain in 50% of runs while two others refused. GitHub validated the finding but declined to treat it as a vulnerability.