Encrypted prompt injection tricks GitHub Copilot CLI into leaking .env secrets

GitHub Copilot CLI can be made to read sensitive files from a developer's machine and send their contents to an attacker from a single web page, according to reporting published October 7, 2026.

Security researchers at Adversa AI said the new attack technique, dubbed Cryptographic Context Injection (CCI), hides malicious instructions inside encrypted content.

What happened

These instructions are treated as trusted context when Copilot CLI decrypts the content using its own code-execution environment, allowing them to influence what the agent does next.

In a demonstration, Adversa researchers got Copilot to read a .env.prod file containing secrets and send its contents to an attacker-controlled endpoint.

The full chain ran in 28 seconds, with no confirmation step and no point in the transcript that named the destination host or indicated that file contents left the machine, the researcher said in a blog post.

The attack is not a universal one-click compromise as it requires Copilot CLI to be running in autopilot mode and a model willing to execute the decrypted instructions.

Impact

Researchers said Microsoft's mai-code-1.1-flash model executed the complete chain in 50% of their runs, while two GPT-5.6 models offered through Copilot consistently refused the same payload.

With Model selection set to Auto, Adversa says the vulnerable model was assigned in some sessions without the user choosing or seeing which model was handling the workflow.

Response

GitHub has validated the finding but declined to treat it as a vulnerability, saying the user had explicitly asked Copilot to fetch attacker-controlled content while giving full permissions to act autonomously.

In a separate advisory, GitHub described a flaw in which an attacker who can influence the commands executed by the agent can exploit bash parameter transformation operators to execute hidden commands, and said the fix made commands with dangerous expansion patterns unconditionally blocked at the tool execution layer, regardless of permission mode including autopilot.

Lessons for security leaders

Security teams should treat autopilot modes and broad tool permissions in coding agents as high-risk defaults, capture every outbound call rather than trusting an agent's closing summary, and track which model an auto-routing feature assigns, since model choice changed whether the exfiltration chain completed.