Flaw or user manual? GitHub validates Adversa's Copilot CLI demo and declines to call it a vulnerability

A coding agent reads what you ask it to read. If that content contains instructions, the agent may follow them. On 6 October 2026, the security firm Adversa AI showed this with GitHub Copilot CLI, the version of Copilot that works in a developer's terminal. GitHub confirmed the demonstration and answered that it was not a product vulnerability.

Prompt injection, in plain words

An AI agent takes instructions from the person using it. It also reads content: web pages, files, emails. Prompt injection means hiding instructions inside that content. The agent cannot always tell the user's request apart from text placed by someone else, and it executes both.

The risk grows with what the agent can do. An assistant that only writes text can produce a wrong answer. An agent that runs commands, reads files and connects to the network can act. It is one of the risks that grow as an AI agent runs in production.

What Adversa showed

According to The Register and CSO Online, which report Adversa's work:

• The starting point. A developer asks Copilot CLI to look at a web page. The CLI runs in autopilot mode, an optional mode in which the agent chains steps without waiting for the user after each one.
• The trap. The page contains encrypted instructions, the method to decrypt them with Python, and two possible keys. The first key is a template the agent fills with secrets taken from local files, such as an .env file (the file where projects often keep their passwords and access keys). Reading these files is the theft itself. The second key works, and the decrypted instructions send the agent to an address that carries the secrets to the attacker.
• Why encryption matters. Adversa says the same instructions in plain text are refused, and that filters which read text do not see an encrypted payload.
• The demo. According to Adversa, quoted by CSO Online, the agent read a .env.prod file and sent it in about 28 seconds, with no confirmation prompt and no line in the transcript naming the destination.
• The model. According to Adversa, Microsoft's mai-code-1.1-flash model ran the full chain in 50% of attempts. Two OpenAI GPT-5.6 models refused. On a paid account with model selection set to Auto, the router sometimes assigned the vulnerable model, without the user knowing.

What GitHub answered

Adversa reported the issue through GitHub's bug bounty programme on 17 September 2026. GitHub's triage team validated the finding without treating it as a vulnerability. A GitHub spokesperson told The Register that the scenario "requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability". GitHub added that it is "always looking for opportunities to improve our products". According to CSO Online, GitHub said it may make the functionality stricter in the future. Adversa disputes this reading.

GitHub's position is consistent with its documentation. Autopilot is entered on purpose (Shift+Tab in the terminal). When it starts without full permissions, the CLI offers to "Enable all permissions (recommended)". With limited permissions, it automatically denies tool requests that require approval. The documentation also suggests running the agent in a sandbox.

What is established, and what is not

Point	Status
The demonstration and its mechanism	Reported by The Register, CSO Online and Cybersecurity News, from Adversa's work
GitHub validated the finding without classing it as a vulnerability	Established: GitHub's statement to The Register
28 seconds, .env.prod file	Reported by Adversa, quoted by CSO Online
50% success with mai-code-1.1-flash, refusal by two GPT-5.6 models	Reported by Adversa, from its own tests
Exploitation in real conditions	Not reported by any source
Fix	None announced

The danger, the advice

The danger	The advice
Autopilot is switched on with all permissions to save time, and the agent is pointed at an external page or repository that nobody has read.	Reserve autopilot for trusted code. For any external content, keep approval step by step, or run the agent in a sandbox.
Passwords and access keys sit in clear text in .env files on the developer's machine, within the agent's reach.	Move secrets to a vault and inject them at runtime. A file the agent cannot read cannot leak.
Model selection is left on Auto. The same tool, with the same request, behaves differently depending on the model served.	Pin the model for sensitive work and record which model answered: it is part of the trace.
The team waits for a fix. GitHub says it is not a product vulnerability, so none is announced.	Treat it as a usage setting: approval for any command that reads secrets or leaves the machine, outbound filtering, a written rule.

What to do this week

1. Find out who uses Copilot CLI, on which machines, and whether autopilot mode is used with all permissions granted.
2. List the secrets in clear text within the agent's reach: .env files, keys in configuration files, tokens in the shell history.
3. Write the rule down. Autopilot only on code and sources you trust, never on an external page or document that nobody has read.
4. Pin the model for sensitive work instead of leaving the choice on Auto, and keep a record of which model answered.
5. Watch the sequence Adversa describes: external content enters the agent, code runs, local files are read, then an unexpected outbound connection.

What a solid team does differently

It requires a human approval for every command that reads secrets or sends data off the machine. It keeps secrets out of local files, in a vault the agent cannot read on its own. It filters outbound network traffic from developer machines. It does not count on the vendor for what the vendor declares outside its scope. As with Copilot spending, which we covered in our article on Copilot Credits, the setting that matters is on your side.

Our Microsoft experts can audit how coding agents are configured on your machines and pipelines. The Human in the Loop offer from 56North, activated on commitment, provides for test campaigns run by trained people, including on how your agents react to injected content.