{
  "entry": {
    "kind": "vuln",
    "slug": "cryptographic-context-injection-an-encrypted-web-page-got-github",
    "name": "cryptographic-context-injection-an-encrypted-web-page-got-github",
    "vendor": "GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability",
    "description": "Adversa AI published a Cryptographic Context Injection attack on GitHub Copilot CLI on 6 October 2026. The user asks the agent to review one attacker-controlled URL; the page carries an encrypted payload that the agent decrypts with its own shell, and the decrypted instructions are then treated as trusted context. In Adversa's demonstration the agent read a local .env.prod and sent every secret in it to the attacker in about 28 seconds, with nothing in the transcript naming the destination or showing that file contents left the machine. The chain needs autopilot mode and a permissive model: Microsoft's mai-code-1.1-flash completed it in half of Adversa's runs while two GPT-5.6 models refused, and with model selection on Auto the user neither chooses nor sees which model handled the session. Adversa reported it on 17 September; GitHub validated the finding but declined to treat it as a vulnerability, and there is no CVE or advisory.",
    "website": "https://adversa.ai/blog/cryptographic-context-injection-github-copilot/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-06",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "cryptographic-context-injection-an-encrypted-web-page-got-github",
      "aliases": [
        "ti-161"
      ],
      "title": "Cryptographic Context Injection: An Encrypted Web Page Got GitHub Copilot CLI in Autopilot to Decrypt Its Own Instructions and Send .env.prod to an Attacker",
      "summary": "Adversa AI published a Cryptographic Context Injection attack on GitHub Copilot CLI on 6 October 2026. The user asks the agent to review one attacker-controlled URL; the page carries an encrypted payload that the agent decrypts with its own shell, and the decrypted instructions are then treated as trusted context. In Adversa's demonstration the agent read a local .env.prod and sent every secret in it to the attacker in about 28 seconds, with nothing in the transcript naming the destination or showing that file contents left the machine. The chain needs autopilot mode and a permissive model: Microsoft's mai-code-1.1-flash completed it in half of Adversa's runs while two GPT-5.6 models refused, and with model selection on Auto the user neither chooses nor sees which model handled the session. Adversa reported it on 17 September; GitHub validated the finding but declined to treat it as a vulnerability, and there is no CVE or advisory.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/copilot-cli"
      },
      "affected": [
        {
          "range": "GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability, so there is no fixed version.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-06",
      "modifiedAt": "2026-10-06",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://adversa.ai/blog/cryptographic-context-injection-github-copilot/"
        }
      ],
      "mitigation": "Do not run Copilot CLI in autopilot mode in directories or on machines that hold production secrets, and pin a model rather than relying on Auto routing for sessions that fetch external content. Keep .env.prod and similar files out of developer working trees, and log each session's tool calls with fully resolved arguments so that a fetch of untrusted content followed by a file read and an outbound request to a new host can be alerted on as a sequence.",
      "detectedByAnomity": true
    }
  }
}