Encrypted web instructions can trick GitHub Copilot CLI into leaking secrets

GitHub Copilot CLI can be induced to read local developer secrets and send them to an attacker-controlled URL by a carefully built web page, according to researchers at Adversa AI, whose findings were reported by The Register on 6 October 2026. Adversa said it disclosed the issue through GitHub's bug bounty programme on 17 September 2026. GitHub's triage team validated the finding but declined to class it as a product vulnerability.

The technique is a variant of indirect prompt injection, where a model reads text from a source other than the user and treats it as an instruction. Adversa calls this version Cryptographic Context Injection, or CCI, and says it is the same weakness the firm previously identified in Grok two months earlier. Instead of hiding instructions in plain or lightly obscured text, the attacker ships them as encrypted data alongside the key material and a prompt to decrypt. "Static guardrails read text; they do not run it," Adversa's Rony Utevsky wrote in a blog post provided to The Register. Classifiers scanning ingested text would miss the ciphertext, unlike base64 or simple substitution ciphers that models learned to decode during training.

The chain described by Adversa starts with the user running Copilot CLI in autopilot mode, which is optional in GitHub's tool but the default in some rival agents, and asking it to fetch a particular URL. The page carries encrypted content, instructions to decrypt it using Python, and two candidate keys. The first key is a template the agent must complete by reading files from disk, such as the user's .env file, so the harvested secrets become part of the key string. That decryption fails. The agent then tries the second key, which works, and is told to fetch a further URL for more context. That URL contains the stolen secrets, so the network request hands them to the attacker.

The attack does not always succeed. According to Adversa, it depends on which underlying model handles the session. Copilot CLI currently uses either Microsoft's mai-code-1.1-flash, which completed the full chain in 50 per cent of attempts, or one of two OpenAI GPT-5.6 models, both of which refused the payload. Utevsky called this a model lottery. On the paid account tested, the vulnerable model was not the default and had to be picked by hand, he said, but on an account left on Auto the router assigned the vulnerable model in some sessions and a safe one in others. "The user does not choose, and does not see, which model handled the session," he said.

A GitHub spokesperson told The Register the company investigated and concluded the attack "requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability". The spokesperson added that GitHub is "always looking for opportunities to improve our products". Adversa disagrees with that assessment and says the attack chain works as described.