# beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot: BeyondTrust: A Hidden Comment on a GitHub Issue Hijacked the Copilot Coding Agent, Stole Its Token and Agent Secrets, and Could Reach CI/CD and Cloud Roles; GitHub Does Not Treat It as a Vulnerability > BeyondTrust: A Hidden Comment on a GitHub Issue Hijacked the Copilot Coding Agent, Stole Its Token and Agent Secrets, and Could Reach CI/CD and Cloud Roles; GitHub Does Not Treat It as a Vulnerability is a high-severity prompt injection issue in GitHub Copilot coding agent, a CI integration. Affected: GitHub Copilot coding agent (cloud agent run in GitHub Actions) on any repository where it is enabled, especially public ones. GitHub does not consider it a vulnerability, so there is no fix.. - **Canonical URL:** https://catalog.anomity.ai/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot - **Aliases:** ti-166 - **Severity:** high - **Attack type:** Prompt injection, Credential theft - **Component:** GitHub Copilot coding agent (CI integration) - **Exploited in the wild:** no known exploitation - **Published:** 2026-10-21 - **Last verified:** 2026-11-01 - **JSON:** https://catalog.anomity.ai/api/entries/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot ## Summary BeyondTrust Phantom Labs (Tyler Jespersen) published on 21 October 2026 an attack chain against GitHub Copilot's cloud coding agent. An issue comment carries a prompt injection inside an HTML comment, invisible in the rendered issue, that uses the XML elements Copilot parses (such as ), so when a user with write access assigns the issue to Copilot the agent installs a pip package from an attacker repository that replaces ls and runs the payload; BeyondTrust says it worked nearly every time in testing. The payload got past the Copilot firewall because github.com is on its allowlist, pushing stolen data to an attacker repository with git. It took the Copilot SWE Agent installation token, which could create and push to any copilot/ branch with commits GitHub shows as verified, and, where workflow-run approval has been turned off, push workflows that obtain a fully privileged GITHUB_TOKEN. It also read repository- and organization-level agent secrets from the runner's environment. Any permissions granted in copilot-setup-steps.yml are injected as a GITHUB_TOKEN that the researchers scraped from Runner.Worker memory, so contents: write allowed pushes to unprotected branches and id-token: write gave OIDC tokens that assumed an AWS role. BeyondTrust reported the findings through HackerOne from 15 May 2026; GitHub classified them as Informational, saying no authorization control is bypassed because a write-access user must assign Copilot. The chain was still unpatched on 15 October, and BeyondTrust says it found exposed repositories at major organizations, including Microsoft and GitHub. ## Affected versions | Affected | Fixed in | | --- | --- | | GitHub Copilot coding agent (cloud agent run in GitHub Actions) on any repository where it is enabled, especially public ones. GitHub does not consider it a vulnerability, so there is no fix. | no fixed version listed | ## Am I affected by this vulnerability? You are affected if you run GitHub Copilot coding agent (cloud agent run in GitHub Actions) on any repository where it is enabled, especially public ones. GitHub does not consider it a vulnerability, so there is no fix.. ## How do I fix it? Before assigning an issue to Copilot, open each comment in edit mode or use Copy Markdown to see hidden content. Restrict the Copilot coding agent to private or internal repositories, keep "require approval for workflow runs" on, and require an extra human reviewer on Copilot-authored pull requests. Grant nothing in the permissions block of copilot-setup-steps.yml beyond what is needed, avoiding contents: write and id-token: write, and pin cloud OIDC trust policies to a specific branch or environment rather than the whole repository. Keep agent secrets repository-scoped and short-lived, avoid organization-level agent secrets for valuable credentials, and rotate them after any suspicious Copilot run. ## References - article: https://www.beyondtrust.com/blog/entry/github-copilot-hidden-prompt-injection-agent-takeover ## Related vulnerabilities - [claude-code-github-action-prompt-injection-credential-theft-microsoft](https://catalog.anomity.ai/vuln/claude-code-github-action-prompt-injection-credential-theft-microsoft) — high - [ghostaction-returns-a-security-audit-yml-workflow-pushed-from](https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from) — high - [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high - [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high - [trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant](https://catalog.anomity.ai/vuln/trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant) — critical - [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high --- Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot