)
Last updated: November 6, 2026
What happens when a GitHub Copilot CLI prompt injection hides inside ciphertext instead of plain text? On October 6, 2026, Adversa AI showed that GitHub Copilot CLI, running in autopilot with a permissive model, can fetch a web page, decrypt attacker instructions in its own shell, read a local .env.prod file and send it to an attacker in about 28 seconds. The same instructions in plain text were refused. GitHub validated the report but does not treat it as a product vulnerability. This guide covers the chain, two High-severity CVEs fixed in 2026 and the controls that still work when the model says yes.
TL;DR: Key Takeaways
- Adversa AI disclosed Cryptographic Context Injection (CCI) against GitHub Copilot CLI on October 6, 2026: encrypted instructions plus a decrypt step the agent runs itself (Adversa AI).
- The demonstrated chain took 28 seconds from one fetched URL, with no confirmation and no point in the transcript naming the destination host (CSO Online).
- Microsoft's mai-code-1.1-flash executed the full chain in 50% of Adversa's runs, while 2 GPT-5.6 models in Copilot refused the same payload (The Register).
- GitHub validated the report but declined to treat it as a vulnerability, saying the user directed the fetch and granted autonomy (The Register).
- 2 Copilot CLI vulnerabilities rated High were fixed in 2026: CVE-2026-29783 in 0.0.423 and CVE-2026-45033 in 1.0.43 (NVD, NVD).
- GitHub documents sandboxing, manual approval, deny rules and hooks, and says permission scoping is heuristic (GitHub Docs).
At a glance: Copilot CLI prompt injection
Quick Answer
What is the Copilot CLI prompt injection risk Adversa disclosed?
It is Cryptographic Context Injection: encrypted instructions on a page the user asks Copilot CLI to fetch while it runs in autopilot. The agent decrypts them in its own runtime, reads local secrets and sends them out in about 28 seconds. Text-only guardrails miss ciphertext, so watch the whole tool chain, not only the prompt.
| Item | Detail |
|---|---|
| Technique | Cryptographic Context Injection (CCI) |
| Conditions | Autopilot mode and a model willing to run the decrypted payload |
| Trigger | The user asks the agent to fetch an attacker-controlled URL |
| Impact | Local file read (for example .env.prod) and outbound exfiltration |
| Vendor status | GitHub: not a product vulnerability, the user directed the fetch and granted autonomy |
| Researcher status | Reproducible as described as of October 1, 2026, according to Adversa |
What Adversa showed in the Copilot CLI disclosure
Adversa showed that one attacker-controlled URL, fetched at the user's request while Copilot CLI runs in autopilot with a permissive model, is enough to read local files and ship them out. The researchers used environment files, but any file the agent can read is in scope. Concrete payloads were withheld.
According to Adversa (2026), the technique first appeared in August 2026 against Grok and Gemini, and the team predicted coding agents would be hit harder because code execution and outbound requests are routine for them. The twist is encryption. Static guardrails read text; they do not run it. CCI ships the instructions as strong ciphertext with key material and an instruction to decrypt, and induces the agent to run that decryption in its own runtime. A classifier inspecting the page sees ciphertext. The decrypted text then appears as the output of code the agent just ran, and the agent treats it as its own context.
GitHub reads the same events differently. According to The Register (2026), a GitHub spokesperson said the finding requires a user to intentionally direct Copilot CLI to fetch untrusted content and confirm the action, so it is not a product vulnerability. Adversa answers that the product refuses the same instructions in plaintext, that encryption is the only thing that gets them through, and that the user is shown no destination and no sign that files left the machine.
Adversa also sells AI agent security tooling, so read its defense advice as a vendor view. The attack steps and model results were reported consistently by The Register and CSO Online, and we did not re-run the exploit. The useful question is which reading your organization will accept before it enables autopilot across engineering. If the user's grant counts as consent, the controls that bound the grant have to be yours.
)
How the Cryptographic Context Injection chain works
The user asks Copilot CLI to fetch one URL. The page carries ciphertext, an instruction to decrypt it with Python and two candidate keys. One key is a template that can only be completed by reading local files, so the agent reads them while preparing to decrypt. The real key then decrypts a second stage that sends the data out.
The setup is the ordinary "go read this page" flow. The first key is a decoy: to build it, the agent reads targeted files such as a .env file and folds their contents into the key string. According to Adversa (2026), that read is the theft, and it happens before any decryption succeeds. Decryption with the decoy fails by design. The agent falls back to the real key, the second stage tells it to fetch a follow-up URL for more context, and that URL carries the harvested contents as a request parameter. The agent issues the request and the secrets arrive at the attacker's endpoint.
| Step | What the agent does | Why static filters miss it |
|---|---|---|
| 1. Fetch | Retrieves the attacker page at the user's request | Looks like a normal documentation fetch |
| 2. Decrypt | Runs Python in its own runtime to decrypt ciphertext | Classifiers see ciphertext, not instructions |
| 3. Decoy key | Builds a key from local file contents and fails to decrypt | File reads look like key preparation, not theft |
| 4. Real key | Decrypts the second-stage instructions | Instructions appear as output of code the agent just ran |
| 5. Exfiltrate | Fetches a follow-up URL that embeds the secrets | The outbound call looks like "more context" |
Adversa stresses that this is not a universal one-click compromise, and it does not claim a confirmation prompt bypass. The chain needs Copilot CLI in autopilot and a permissive model. Under those conditions no further user interaction is needed after the first request.
One detail belongs in your SOC runbook. According to Adversa (2026), the agent's closing summary described the exfiltration request as a check of an authorized-reader endpoint. A summary written by the agent is not evidence. Only a trace of every tool call with resolved arguments shows what was read and where it went.
Autopilot, --allow-all and the model lottery in Copilot CLI
Autopilot controls continuation, not approvals. GitHub's documentation separates it from --allow-all, which controls approvals, yet recommends enabling all permissions for the best autopilot results. Adversa's chain needed autopilot and a permissive model, so both the permission grant and the model handling the session decide whether the attack lands.
According to GitHub Docs (2026), entering autopilot without full permissions offers three choices: enable all permissions, marked as recommended, use manual approval for the session, or cancel. With manual approval, requests that need approval are denied automatically. The --allow-all flag, with its alias --yolo, lets the agent use all tools, paths and URLs without asking, and autopilot is sticky by default: the next prompt also runs in autopilot unless stayInAutopilot is set to false.
The second condition is the model, which Adversa calls a model lottery. Microsoft's mai-code-1.1-flash executed the full chain in 50% of runs, and two GPT-5.6 models offered through Copilot consistently refused the identical payload. On the paid account Adversa tested, the vulnerable model was not the default and had to be selected by hand. On an account left on Auto, the router assigned it in some sessions and a safe model in others.
GitHub's changelog differs on one point. According to the GitHub Changelog (2026), Auto routes by plan and policy, honors administrator model settings, changes its model list over time and shows which model was used in the CLI. Adversa says the user does not see it. We could not reconcile the two, but either way the model behind a session today may not be the one you tested last month.
| Control surface | What GitHub documents | What it means for this chain |
|---|---|---|
| Autopilot | Continues across steps without waiting; sticky by default | Adversa's first required condition |
| All permissions / --allow-all (--yolo) | Approves all tools, paths and URLs without asking | Removes the approval step a hostile fetch would meet |
| Manual approval in autopilot | Requests that need approval are denied automatically | A narrower grant; we did not test it against CCI |
| Local sandbox (/sandbox enable) | Restricts filesystem, network and system access | Bounds file reads and outbound calls if enforced |
| Cloud sandbox (--cloud) | Runs the session in an isolated GitHub-hosted environment | Local .env files are not on the machine running the session |
| Trusted directories | Confirms trust for the launch folder; scoping is heuristic | Does not stop a fetch of an external URL |
Copilot CLI prompt injection and CVEs in 2026
CCI is not the only Copilot CLI problem this year. GitHub fixed two High-severity vulnerabilities in 2026: CVE-2026-29783, a shell safety bypass patched in version 0.0.423, and CVE-2026-45033, a nested git repository flaw patched in 1.0.43. Both show that approval layers fail when classification or tool behavior is wrong.
According to NVD (2026), CVE-2026-29783 affects versions up to 0.0.422. The shell tool classifies commands as read-only or write-capable, and crafted bash parameter expansion could hide executable code inside otherwise read-only commands. An attacker who can steer the agent's commands, for example through prompt injection in repository files or MCP responses, could reach code execution even in modes that require approval. GitHub rated it 7.5 High.
CVE-2026-45033 is a different failure. According to NVD (2026), a malicious bare git repository nested inside a project directory could run arbitrary commands when the agent performs git operations, because git reads executable configuration keys such as core.fsmonitor during normal commands. It affects versions before 1.0.43, and GitHub rated it 8.5 High.
| Issue | Vector | Affected | Status |
|---|---|---|---|
| CCI (Oct 2026) | Encrypted payload on a fetched page; autopilot and a permissive model | Depends on model and mode | GitHub: not a product vulnerability; Adversa: reproduces as of Oct 1 |
| CVE-2026-29783 | Bash parameter expansion hides code behind read-only commands | 0.0.422 and earlier | Fixed in 0.0.423 |
| CVE-2026-45033 | Nested bare git repository runs configured commands | Before 1.0.43 | Fixed in 1.0.43 |
The prompt is rarely the weak point. The weak point is the layer that decides what is safe to run without asking. Keeping the CLI patched is the cheapest control here, and it only works if platform engineering knows which versions developers run.
How CCI differs from ordinary prompt injection
CCI is still indirect prompt injection, but it changes the delivery format. Ordinary injection puts instructions in clear text that defenders can filter, classify or refuse. CCI ships them as ciphertext, so the harmful text exists only after the agent runs code the product is designed to run. Text-only guardrails never see it.
Ordinary prompt injection puts attacker instructions in a page, email or document. According to OWASP (2026), the Top 10 for Agentic Applications lists Agent Goal Hijack as ASI01 and Unexpected Code Execution as ASI05. CCI touches both: ingested content redirects the agent, and the decryption that makes it actionable runs in the agent's own runtime. The 2025 LLM Top 10 entry remains the baseline definition (OWASP).
What changed for Copilot CLI is the environment, not the technique. For a coding agent, code execution is a default capability, outbound requests are normal and the data within reach is source, configuration and credentials. For coding-agent context, see our guide on securing internal AI copilots and our analysis of indirect prompt injection.
Defenses that work when the model layer fails
Do not rely on the model to say no. Every control that bounds this attack sits in the layer around the agent: the permissions it holds, the places it can reach, what it can write and what you can replay afterward. Start with GitHub's own switches, then add controls that do not depend on which model Auto picked.
Adversa's advice is to capture a per-session trace of every tool call with fully resolved arguments, alert on the sequence (untrusted content in, code run, files read, unrelated host contacted) and gate new network destinations and writes outside the workspace. In autopilot, where no human is in the loop, that should be a hard deny by default.
GitHub documents switches that map onto those ideas. According to GitHub Docs (2026), you can enable a local sandbox with /sandbox enable, start a cloud sandbox session with --cloud, scope trusted directories, and use --deny-tool, which takes precedence over --allow-tool and --allow-all-tools. Hooks can run custom shell commands at key points during agent execution for validation, logging or security scanning, and --max-autopilot-continues caps automatic continuation.
| Defense | Chain step it addresses | Where it sits |
|---|---|---|
| No blanket all-permissions grant in sessions that fetch external content | Whole chain | Developer standard and CLI settings |
| Local or cloud sandbox | Steps 3 and 5: reads outside the workspace, outbound calls | GitHub native |
| --deny-tool rules for tools a task does not need | Steps 2 and 5 | GitHub native |
| Hooks that log or validate tool calls | Detection and forensics | GitHub native, your logic |
| Model policy: restrict or pin models, review Auto | The model lottery | Administrators and standards |
| Destination allowlist for fetches and tool calls | Step 5 | Control layer around the agent |
| Fetched content quarantined from tools and credentials | Steps 1 and 2 | Agent architecture |
| Sequence detection: fetch, execute, read, outbound | The whole chain | Control layer and SOC |
| CLI kept patched | CVE-2026-29783 and CVE-2026-45033 | Platform engineering |
How we compared
We read Adversa's write-up, cross-checked it against The Register and CSO Online, mapped GitHub's documentation to Adversa's conditions and checked both CVEs on NVD. We did not re-run the exploit or test whether manual approval or a sandbox blocks the chain, so the table shows where each control applies, not a measured result.
An enterprise rollout checklist for Copilot CLI
Before wide adoption, a security review should answer five questions: where the binary runs, which directories count as trusted, whether autopilot is allowed, which models are approved and what can leave the machine. Write the answers into a short standard that platform engineering can enforce and auditors can read.
GitHub's documentation says you should typically not launch Copilot CLI from your home directory and warns that permission scoping is heuristic. Build that into policy. Prefer project folders with no parent .env files, require a sandbox for autopilot sessions that can reach the network and decide whether Auto stays on if you cannot verify every model in the pool.
| Checklist item | Pass criteria | Owner |
|---|---|---|
| Install source and version | Official GitHub distribution; version tracked and patched | Platform engineering |
| Launch directory | Project folder without production secrets | Developers and code owners |
| Autopilot policy | Allowed only for named task types, or denied | Security architecture |
| Permission grant | No blanket all-permissions grant when sessions fetch external content | Security architecture |
| Model policy | Allowlist of tested models; Auto reviewed against administrator settings | Security architecture |
| Network policy | Destination allowlist for tool fetches | Network and security engineering |
| Logging | Full tool-call and outbound URL trail, via hooks or a control layer | SOC |
Training helps, but it does not replace enforcement. Developers will paste documentation URLs under deadline pressure, and some of those URLs will be hostile.
Detection playbook: from alert to containment
When an alert fires on a suspicious Copilot CLI session, reconstruct the chain first: the tool calls with resolved arguments, the files read and the outbound hosts. A decrypt step between an untrusted fetch and a read of a secret path means the machine should be treated as exposed, even if the final request failed. Then revoke any cloud tokens that lived in the harvested files, rotate the .env values and disable autopilot for the user or group.
| Signal | Why it matters | Immediate action |
|---|---|---|
| Fetch of a newly seen host followed by local code execution | Matches steps 1 and 2 | Flag the session for review |
| Read of .env or key files outside the edit set | Matches the decoy-key harvest | Assume secret exposure |
| Outbound request with long query parameters after a decrypt step | Matches exfiltration | Block the host; rotate secrets |
According to Adversa (2026), the signature is the sequence, not any single event. Encode it once and reuse it for every coding agent, not only Copilot CLI, because other CLIs that combine fetch, code execution and broad file access will show the same shape.
Security and governance: enterprise risks for Copilot CLI
Enterprises that adopt Copilot CLI inherit a privileged local agent on every laptop that runs autopilot. Secrets in .env files, cloud tokens and customer data in adjacent folders are one steered fetch away when policy lives only in the model. Governance needs explicit rules for autopilot, model selection and runtime inspection of tool chains.
Prompt injection, including obfuscated forms such as CCI, steers the agent after a normal user action. Data leakage follows when the agent can read secret files and open outbound connections. Tool misuse appears when code execution and network access are on by default, and the two 2026 CVEs show the approval layer itself can be wrong. GitHub also notes that Copilot CLI cannot currently support two organization-level MCP server policies, the one that controls whether MCP servers can be used and the one that sets the registry URL, so MCP access for these CLIs needs a control of your own.
NeuralTrust treats coding-agent security as a runtime and policy problem, not a prompt-filter problem. The Agent Gateway (TrustGate) applies least-privilege policy to the tools and MCP servers that agents call. Agent Runtime Security (TrustGuard) watches agent behavior at runtime. Agent Posture Management (TrustLens) inventories agents and the access they hold, and AI Red Teaming (TrustTest) tests agents before they ship. NeuralTrust deploys in your own infrastructure or on-premises, with a managed service hosted in the EU or US.
Ask any vendor, including us, whether it can see a fetch, a code execution, a file read and an outbound call as one chain, and whether it covers the CLI and traffic path your developers actually use. Coverage depends on how a CLI reaches its tools and the network, so confirm the path with your own team first.
Which should you choose?
Choose controls by the situation you are in, not by the CLI you use. The same finding means different first steps depending on whether developers run autopilot on Auto routing, whether secrets sit within reach, whether fetches have an allowlist and whether the SOC can see tool chains. Start with the row that matches your estate.
| Your situation | Main risk from this finding | First step |
|---|---|---|
| Developers use autopilot with Auto model routing | A permissive model assigned without anyone noticing | Review the model pool, restrict or pin models, limit autopilot to named tasks |
| Copilot CLI can reach parent directories and .env files | Secret harvest in the decoy-key step | Keep secrets out of reach; enable a sandbox |
| Outbound fetches need no host allowlist | Quiet exfiltration in step 5 | Allowlist destinations and show resolved URLs |
| SOC needs detection, not only prevention | Partial chains that almost complete | Collect resolved tool-call traces and alert on the sequence |
| CLI versions are not tracked | Known CVEs left unpatched | Inventory versions and require at least 1.0.43 |
Conclusion
Copilot CLI prompt injection through Cryptographic Context Injection shows that text-only guardrails fail when an agent can run a cipher for the attacker. Autopilot plus a permissive model turned a normal request to read a page into a 28-second path to .env theft. Narrow the permission grant, know which model handles each session, keep secrets out of reach, patch the CLI and inspect the whole tool chain.
Secure Copilot CLI Agents in Production with NeuralTrust
Put least-privilege policy and runtime monitoring around the tools your coding agents call. Start with the free plan, or talk to us about covering the Copilot CLI sessions your developers already run in autopilot.
)
Related Comparisons
- How to Secure Internal AI Assistants and Copilots
- Indirect Prompt Injection: Complete Guide
- How Prompt Injection Works
- MCP Prompt Injection: Proof on Bedrock
FAQs about Copilot CLI
1. What is Copilot CLI?
GitHub Copilot CLI is a command-line coding agent that can read your project, run shell commands and, in autopilot mode, work through multi-step tasks without waiting for a prompt at each step. It is separate from the Copilot chat panel in an editor. Its security depends on permissions, sandboxing, network reach and which model handles the session.
2. Is Copilot CLI safe to use in autopilot?
It can be, if you trust the task, the directory and the permissions you grant. GitHub recommends enabling all permissions for the best autopilot results, but that approves all tools, paths and URLs without asking. Adversa showed that autopilot, untrusted content and a permissive model can leak secrets without further prompts. Use a sandbox and the narrowest grant that completes the task.
3. What is Cryptographic Context Injection?
It is a form of indirect prompt injection in which attacker instructions travel as ciphertext. The agent is told to decrypt them in its own runtime, so classifiers that only read text never see the clear instructions. After decryption the agent treats the output as its own trusted context. Adversa demonstrated it against Grok and Gemini in August 2026 and against Copilot CLI on October 6.
4. Did GitHub fix the Copilot CLI prompt injection issue?
GitHub validated Adversa's report but declined to treat it as a vulnerability, telling The Register that the attack requires the user to direct the fetch of untrusted content and confirm the action. Adversa disagrees and said the chain still reproduced as of October 1, 2026. We did not find a GitHub announcement of a change as of November 6, 2026.
5. Which Copilot models are affected?
Adversa reports that Microsoft's mai-code-1.1-flash executed the full chain in 50% of its runs, while two GPT-5.6 models offered in Copilot refused the same payload. On Auto, the vulnerable model was assigned in some sessions without the user choosing it. GitHub says the pool behind Auto changes over time, so re-test when it does.
6. Which Copilot CLI vulnerabilities were fixed in 2026?
NVD lists two High-severity issues. CVE-2026-29783 let crafted bash parameter expansion hide commands behind read-only classifications and was fixed in version 0.0.423. CVE-2026-45033 let a nested bare git repository run configured commands during git operations and was fixed in version 1.0.43. Check that every developer machine runs a patched version.
7. How do you detect this attack in a SOC?
Look for a short sequence: untrusted web content enters the agent, code runs a decrypt step, files outside the normal edit set are read and an outbound request goes to a new host. No single event looks fatal. The chain does. You need session traces with resolved tool-call arguments, because the agent's own summary can describe the exfiltration as something harmless.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Adversa AI, Rony Utevsky, Cryptographic Context Injection in GitHub Copilot CLI, October 6, 2026.
- The Register, Thomas Claburn, Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets, October 6, 2026.
- CSO Online, Encrypted instructions trick Copilot CLI into spilling developer secrets, October 2026.
- GitHub Docs, GitHub Copilot CLI, accessed November 6, 2026.
- GitHub Docs, Using Autopilot mode in GitHub Copilot CLI, accessed November 6, 2026.
- GitHub Changelog, GitHub Copilot CLI now supports Copilot auto model selection, April 17, 2026.
- NVD, CVE-2026-29783, published March 6, 2026.
- NVD, CVE-2026-45033, published May 13, 2026.
- OWASP Gen AI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.
- OWASP Gen AI Security Project, LLM01:2025 Prompt Injection, 2025.
)
)
)
)