Researchers Uncover Encryption-Based Injection Flaw in GitHub Copilot CLI That Can Leak Developer Secrets

Security researchers have identified a vulnerability in GitHub's Copilot command‑line interface that could allow an attacker to siphon confidential developer data by embedding hidden instructions within encrypted prompts.

Copilot CLI extends the popular AI‑driven code completion service to terminal workflows, enabling developers to generate code snippets, scripts, or configuration files directly from the shell. The tool processes user prompts, sends them to the Copilot model, and returns generated content, a convenience that has quickly become part of many developers' toolkits.

The newly disclosed attack, dubbed Cryptographic Context Injection (CCI), leverages the way the CLI encrypts and transmits user prompts. An adversary can host a malicious webpage that serves specially crafted, encrypted payloads. When a developer runs a Copilot CLI command that fetches input from that page, the concealed instructions are decrypted by the CLI and executed as part of the prompt, prompting the model to reveal stored secrets such as API keys, tokens, or passwords.

Because the malicious payload is hidden inside valid encryption, standard integrity checks fail to detect it, and the CLI unwittingly includes the attacker‑controlled content in the request to the Copilot service. The model then returns output that includes the requested secret, effectively turning the AI assistant into a conduit for data exfiltration.

The flaw was first reported by the security outlet GBHackers, which provided a proof‑of‑concept demonstration. GitHub has been notified and is reportedly reviewing the issue, though no official patch or timeline has been announced. In the meantime, researchers advise developers to avoid pulling prompt data from untrusted sources and to limit the exposure of sensitive credentials in environments where Copilot CLI is active.

This discovery adds to a growing list of security concerns surrounding AI‑assisted development tools. Earlier incidents have highlighted the risk of accidental secret leakage when code generation models are fed unrestricted context. GitHub already runs secret‑scanning on repositories, but the dynamic nature of CLI interactions introduces a new attack surface that static analysis cannot fully cover.

Industry observers note that the episode underscores the need for robust input validation and encryption handling within AI tooling. As AI becomes more embedded in software supply chains, both tool providers and users will likely adopt stricter controls, such as sandboxed execution environments and stricter provenance checks for external content.

For now, developers using Copilot CLI are urged to monitor updates from GitHub, apply any forthcoming mitigations promptly, and review their secret management practices to ensure that credentials are not inadvertently exposed through AI‑driven workflows.