In June 2025, I found a critical vulnerability in GitHub Copilot Chat (CVSS 9.6) that allowed silent exfiltration of secrets and source code from private repos, and gave me full control over Copilot's responses, including suggesting malicious code or links. The attack combined a novel CSP bypass using GitHub's own infrastructure with remote prompt injection. I reported it via HackerOne, and GitHub fixed it by disabling image rendering in Copilot Chat completely.
Curated from legitsecurity.com · 8 October 2025 →
The same researcher who did the GitLab Duo work, five months later, on GitHub. Instructions hidden in a pull request comment were read by Copilot Chat when a maintainer asked it about the repository, and the answer to how the data got out is the elegant part: GitHub proxies remote images through its own domain, Camo, so an image URL built by the injected instruction is served from GitHub itself and passes GitHub's own content security policy. Private source code, AWS keys and unpublished vulnerability reports all went out that way. GitHub's fix was to stop Copilot Chat rendering images at all, which is the same fix Google reached on Bard two years earlier and the same one GitLab reached in between.
