Security researchers at Adversa AI found GitHub Copilot CLI can be tricked by malicious web pages using encrypted 'Cryptographic Context Injection' instructions into reading local secrets (e.g. .env files) and exfiltrating them to an attacker-controlled URL, depending on which underlying model handles the session. GitHub's triage team validated the finding but declined to classify it as a product vulnerability, arguing user consent was required to trigger the action.
Disclosed 17 September 2026 · Record updated 6 October 2026
Demonstrated attack chain can cause the coding agent to read and transmit developer secrets (such as .env file contents) to an attacker, with success depending on which model (e.g. Microsoft's mai-code-1.1-flash vs OpenAI GPT-5.6) handles the session; GitHub disputes it is a product vulnerability.
VulnerabilitiesAdversa AI says a malicious page can make the coding agent read a developer's .env file and send it to an attacker, but GitHub says it is not a product flaw.
6 Oct 2026
