GitHub Agentic Workflows sent Copilot credentials to an unintended AI provider

GitHub Agentic Workflows mapped a Copilot GitHub credential into an OpenAI-style environment variable for some external engines. The provider adapter then sent the credential to an unexpected API endpoint.

GHSA-vc9g-q5h8-x44c reports full-token transmission to genuine OpenAI and partial token fragments in generated error artifacts. Sending to OpenAI is not evidence that an attacker controlled the destination or possessed the full token.

The boundary crossed was between two legitimate providers, not from GitHub directly to an attacker-controlled host. A GitHub Agentic Workflows integration mapped COPILOT_GITHUB_TOKEN into an OpenAI-style environment variable for certain universal-llm-consumer engines. Its adapter then sent the whole bearer token in an Authorization header to the genuine OpenAI models endpoint, where an error exposed a partial token string in an artifact. Sending a credential to the wrong audience is a secret-handling failure even when the receiving domain is reputable. The public fragment does not itself permit reconstruction of the full token, and the advisory does not establish subsequent attacker use. The published fix is 1.2.0, subject to validating the actual executed provider configuration.

The full Copilot token was sent to a real but unintended provider because an adapter mapped credentials by a convenient environment-variable name rather than the actual token audience. The later public artifact contained only a fragment returned in an error, which is a different exposure from the full-token transmission. This is not the same root cause as the older gh-aw API-proxy URL-parsing case. Regressions must inspect outbound Authorization headers for every supported model adapter and verify that error artifacts cannot reproduce credential-bearing responses.