An encrypted web page tricked GitHub Copilot CLI into leaking a .env file
Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with encrypted instructions. GitHub validated the report but does not consider it a vulnerability.
Adversa AI published research on October 6 showing that GitHub Copilot CLI, running in autopilot mode, can be steered by a web page into exfiltrating local secrets. The page holds encrypted instructions plus two candidate keys. The first key is a template the agent fills in by reading local files, in Adversa's test a .env.prod; that key fails to decrypt by design, the real key works, and the decrypted step tells the agent to fetch a second URL carrying the harvested contents. Adversa calls the technique Cryptographic Context Injection and says the chain took 28 seconds with no confirmation prompt. Microsoft's mai-code-1.1-flash model completed it in half of attempts; two GPT-5.6 models refused. Adversa reported it through GitHub's bug bounty on September 17. GitHub validated the finding but said it is not a product vulnerability because the user must direct the CLI to fetch untrusted content.
Why it matters
The control that failed is not the model; it is that a coding agent running as the developer can read every secret on disk and make outbound requests in the same session. Encryption is there to get past content classifiers that read text but do not execute it, so filtering the fetched page is not a defence you can rely on. Whether a session is exposed also depends on which model the Auto router picked, which the user cannot see.
Practical checks: keep production .env files off developer machines where agents run, prefer short-lived credentials pulled from a secrets manager at runtime, and do not combine autopilot with fetching arbitrary URLs. If a team has used autopilot against untrusted pages, rotate what was in the working directory. Background on the pattern is in agent instruction injection and the earlier GhostSplice research. The technical details are in Adversa's write-up.
Source: The Register
Related on Start with Identity
- BlogGheist turns stolen GitHub tokens into secret dumps through Actions logs
Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-syn
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- BlogGhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos
GitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEGitHub Enterprise Server SAML encrypted-assertion bypass
GHES with optional encrypted SAML assertions accepted a forged response. An unauthenticated attacker could provision a site administrator. Fixed in 3.9.15, 3.10