Adversa’s demonstration began with an authorized request for GitHub Copilot CLI to inspect attacker-controlled web content while running in autopilot. Encrypted instructions and a malicious key-construction pretext caused the agent to read a local .env.prod test file, then send its contents through an outbound request after decrypting a second stage. The…
Inspect the ClaimsCase · DiggingBeagle record
Encrypted webpage instructions induced Copilot CLI to leak a test secret in autopilot mode
Adversa demonstrated a controlled Copilot CLI attack in which encrypted instructions from a webpage reached agent execution, producing local file reads and outbound secret transmission.
Scope
Adversa’s controlled Copilot CLI autopilot tests against selected model routes, with user-granted broad execution permissions and attacker-controlled webpage content.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Adversa showed local test-secret exfiltration in a highly permissive Copilot CLI autopilot run. A vendor bounty reviewer reportedly disagreed that it was a product vulnerability. The controlled 28-second run and model-specific percentages are not evidence of field victimization.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CCI-DEMO · CLM-CCI-MODEL-SPLIT · CLM-CCI-TRIAGE · Adversa AI: Cryptographic Context Injection in GitHub Copilot CLI
At a glance
Removing broad automatic tool approval, denying the agent unneeded secret-file reads, and limiting outbound requests break different segments of the demonstrated chain. Choosing a model that refused this payload does not establish a durable security guarantee because another supported model route behaved differently.
Read the implicationsExact trial denominator for the reported 50% MAI-Code-1.1-Flash success rate. Reproducibility after CLI or model updates and with narrower filesystem and network permissions. No established deployment victim or unauthorized production extraction.
Limits and uncertaintyFull account
Adversa’s demonstration began with an authorized request for GitHub Copilot CLI to inspect attacker-controlled web content while running in autopilot. Encrypted instructions and a malicious key-construction pretext caused the agent to read a local .env.prod test file, then send its contents through an outbound request after decrypting a second stage. The complete controlled chain took 28 seconds. In the researchers’ trials MAI-Code-1.1-Flash completed the chain in 50% of runs, while two tested GPT-5.6 variants refused; the trial denominator is not provided. GitHub’s bounty reviewers validated the report but did not classify this fully authorized autopilot workflow as a product vulnerability. No real victim exfiltration is established.
Mechanism and trust boundary
- 01
Attacker webpage
Encrypted instructions arrive as untrusted page content in an authorized browse workflow.
Boundary: Remote page data to coding agent input
- 02
Runtime decoding and read
The agent executes decryption and key preparation, which accesses the local secret file.
Boundary: Untrusted text to agent code execution and filesystem authority
- 03
Outbound request
A subsequent request carries test secret content to a researcher-controlled endpoint.
Boundary: Local developer secrets to external network endpoint
Claims & evidence
CLM-CCI-DEMOAdversa reports a 28-second controlled Copilot CLI autopilot run that read a local test .env.prod file and sent its contents to an attacker-controlled endpoint after processing encrypted webpage instructions.supported
Basis: reported finding
- supportsAdversa AI: Cryptographic Context Injection in GitHub Copilot CLIprimary disclosure
How the GitHub Copilot CLI data exfiltration works, final paragraphs
CLM-CCI-TRIAGEAdversa says GitHub validated its submission but declined to classify the user-authorized autopilot behavior as a product vulnerability.supported
Basis: reported finding
- supportsAdversa AI: Cryptographic Context Injection in GitHub Copilot CLIprimary disclosure
Disclosure timeline
CLM-CCI-MODEL-SPLITAdversa reports 50% successful runs with MAI-Code-1.1-Flash and refusals by two tested GPT-5.6 variants; the report does not give the number of runs.supported
Basis: reported finding
- supportsAdversa AI: Cryptographic Context Injection in GitHub Copilot CLIprimary disclosure
A model lottery you can’t see
Implications
Removing broad automatic tool approval, denying the agent unneeded secret-file reads, and limiting outbound requests break different segments of the demonstrated chain. Choosing a model that refused this payload does not establish a durable security guarantee because another supported model route behaved differently.
Unknowns and contradictions
- Exact trial denominator for the reported 50% MAI-Code-1.1-Flash success rate.
- Reproducibility after CLI or model updates and with narrower filesystem and network permissions.
- No established deployment victim or unauthorized production extraction.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123