Evidence · DiggingBeagle record
BeyondTrust: hidden issue comments and Copilot authority
Researcher disclosure of a demonstrated chained attack.
- Source role
- primary disclosure
Evidence record
Researcher disclosure of a demonstrated chained attack.
Claim-level citations (3)
- supportsHidden issue content can redirect Copilot into its available credentials: BeyondTrust reports a hidden-comment injection causing Copilot token and agent-secret exfiltration and writes to Copilot branches.
Introduction; secret-exfiltration and branch-poisoning demonstrations
- supportsHidden issue content can redirect Copilot into its available credentials: The researcher says behavior remained present October 15 and records GitHub classifying the submissions as Informational or otherwise outside its security-risk determination.
Disclosure timeline; Am I affected?
- supportsHidden issue content can redirect Copilot into its available credentials: The demonstrated CI/cloud escalation depends on additional setup-workflow permissions, unprotected branches or permissive OIDC trust.
CI/CD Takeover; Contents: Write; Id-token: write; controlled AWS role example