Executive Summary#
This is Cryptographic Context Injection (CCI) moved out of the chat window and into the developer’s terminal. In earlier research against Grok I showed that a model trusts the output of its own code execution as if it were trusted internal context — and that an AES-encrypted payload on an ordinary webpage can launder attacker instructions past content filters because recovering them requires the runtime. Against Grok that leaked real users’ chat histories. Against GitHub Copilot CLI, the same primitive leaks something developers care about even more: their secrets.
The victim’s action is entirely ordinary for a coding agent: “go read this page.” The agent fetches one attacker-controlled URL, decrypts an embedded payload in its own shell, and treats the decrypted instructions as trusted context rather than untrusted web content — then reads local files (including .env.prod and files outside the working directory) and ships their contents to an attacker endpoint. The full chain runs in ~28 seconds, and nothing on screen reveals that data left the machine — the agent’s own closing summary reported it had “confirmed an authorized-reader endpoint.”
Severity: CRITICAL (coding agents with file access + egress)
- Technique: Cryptographic Context Injection
- Impact: Silent exfiltration of developer secrets (e.g.
.env.prod, files outside the working directory) - Affected: GitHub Copilot CLI (reported 17 Sept 2026 — triaged, assessed as not-a-vulnerability, unfixed at publication)
- Delivery: A single benign “fetch this URL” request while the agent runs unattended; no confirmation before exfiltration
- Root Cause: Decrypted code-execution output treated as trusted context, not as untrusted input
Why a Coding Agent Is the Worst Place for This Flaw#
The trust-boundary failure is identical to the Grok attack — strong encryption forces decryption through the runtime, and runtime output is treated as trusted. What changes is the environment. A coding agent is built to do exactly the things an attacker needs: execute code, read the filesystem, and make outbound network requests — all as routine, expected behavior. The data within reach is no longer just a chat history; it is developer credentials, production environment files, and source outside the project directory. The technique is unchanged; the blast radius is much larger.
How It Works#
- Weaponized page. The attacker hosts an ordinary-looking page containing an encrypted payload and the instructions needed to decrypt it in the agent’s shell.
- Routine request. The developer asks Copilot CLI to fetch and read the URL — a normal “go look at this” task while the agent runs unattended.
- Filters are blind. Static content filters cannot read the payload; recovering it requires runtime execution.
- Shell decrypts. The agent decrypts the blob in its own shell, materializing the attacker’s instructions as trusted runtime output.
- Context confusion. The agent treats that decrypted output as part of its own task context rather than as untrusted external input.
- Privileged action. The instructions drive the agent to read local files — including
.env.prodand files outside the working directory. - Exfiltration. Secrets leave through outbound requests to an attacker-controlled endpoint — invisibly to the developer, in about 28 seconds.
A practical precondition worth stating honestly: the chain needs the agent running in an autonomous (“autopilot”) mode, and it depends on the session model. With model selection hidden behind Auto routing, this is not under the user’s visible control — in testing one routed model ran the chain roughly half the time, while two others refused it.
Disclosure#
Reported to GitHub’s bug bounty program on 17 September 2026. On 1 October 2026, GitHub triage validated the behavior but assessed it as not a vulnerability and ruled the report ineligible for the bounty, noting it “may make the functionality stricter in the future.” I disagree with that assessment: the chain still reproduces, and it turns a routine agent request into silent theft of developer secrets. Payloads are withheld to avoid enabling exploitation.
Full Research and Details#
For the complete technical breakdown, proof-of-concept, and vendor timeline, read the original publication:
👉 GitHub Copilot CLI: Cryptographic Context Injection Steals Developer Secrets (Published on Adversa AI)
Related: Cryptographic Context Injection against Grok — the same primitive used for zero-confirmation chat-history theft. And the origin: Cryptographic Payload Injection.
