Hidden issue content can redirect Copilot into its available credentials

An issue assigned by a repository writer becomes the entry point for attacker-controlled hidden content. The same demonstrated chain reaches additional authority only where deployment permissions and cloud trust permit it.

Mechanism, preconditions and effects. The attacker needed a repository issue or comment that the coding agent would later read, plus a legitimate user with write permissions to assign the agent. Instructions inside HTML comments did not render visibly to that user but remained available to Copilot's parser, which read them with issue context. BeyondTrust's demonstrated chain redirected agent tool use toward available tokens, repository or organizational secrets and attacker-controlled output locations. Subsequent CI/OIDC escalation required additional workflow configuration or privileges, and should not be folded into the basic entry mechanism.

Comparison and evidence limits. GitHub's position, as documented in the researcher's disclosure timeline, was that assignment by an authorized user means no platform authorization bypass occurred; that interpretation does not refute the observed indirect instruction route. The cited disclosure is from the researcher, and the supplied record does not establish production-victim credential theft. Unlike repository-imposed build instructions, hidden comments are unseen in the rendered issue while still being consumed by the assistant.