Cryptographic Context Injection: An Encrypted Web Page Got GitHub Copilot CLI in Autopilot to Decrypt Its Own Instructions and Send .env.prod to an Attacker
Cryptographic Context Injection: An Encrypted Web Page Got GitHub Copilot CLI in Autopilot to Decrypt Its Own Instructions and Send .env.prod to an Attacker is a medium-severity prompt injection issue in GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability, an AI agent. Affected: GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability, so there is no fixed version..
Is GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
cryptographic-context-injection-an-encrypted-web-page-got-github- Severity
- medium
- Attack type
- Prompt injection, Data exfiltration
- Component
- GitHub Copilot CLI · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Adversa AI published a Cryptographic Context Injection attack on GitHub Copilot CLI on 6 October 2026. The user asks the agent to review one attacker-controlled URL; the page carries an encrypted payload that the agent decrypts with its own shell, and the decrypted instructions are then treated as trusted context. In Adversa's demonstration the agent read a local .env.prod and sent every secret in it to the attacker in about 28 seconds, with nothing in the transcript naming the destination or showing that file contents left the machine. The chain needs autopilot mode and a permissive model: Microsoft's mai-code-1.1-flash completed it in half of Adversa's runs while two GPT-5.6 models refused, and with model selection on Auto the user neither chooses nor sees which model handled the session. Adversa reported it on 17 September; GitHub validated the finding but declined to treat it as a vulnerability, and there is no CVE or advisory.
Affected versions
| Affected | Fixed in |
|---|---|
GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability, so there is no fixed version. | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability, so there is no fixed version..
How do I fix it?
Do not run Copilot CLI in autopilot mode in directories or on machines that hold production secrets, and pin a model rather than relying on Auto routing for sessions that fetch external content. Keep .env.prod and similar files out of developer working trees, and log each session's tool calls with fully resolved arguments so that a fetch of untrusted content followed by a file read and an outbound request to a new host can be alerted on as a sequence.
How do I find every machine running GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run GitHub Copilot CLI in autopilot mode with a permissive model or Auto model routing. GitHub does not treat it as a vulnerability and which version, then enforce a policy on it.