Misbehavior1 sourceFirst seen
Copilot Frees Claude: Coding Agents Break Each Other Out of Their Sandboxes
Ourtake
Turns out the coding agents were passing notes through each other's config files. Microsoft looked at the note and shrugged.
What happened
A security researcher demonstrated that GitHub Copilot, hijacked through indirect prompt injection, could write to Claude Code's configuration files and add a malicious MCP server, so Claude Code would run arbitrary code. The researcher reported the demo to Microsoft, which judged it not severe enough for immediate security servicing.