GitHub Copilot Flaw Allows Attackers to Steal Source Code from Private Repositories

A critical weakness in GitHub Copilot Chat discovered in June 2025 exposed private source code and secrets to attackers, rated CVSS 9.6. According to Legit Security, the vulnerability combined a novel Content Security Policy bypass with remote prompt injection, enabling attackers to exfiltrate private repository data and even inject malicious code suggestions.

The attack relied on embedding hidden prompts in pull request descriptions, which loaded into Copilot’s context when any user viewed the PR, with invisible comments remaining hidden from human readers. Initial tests used a simple “HOORAY” message, but researchers escalated to full command sets to search private code for secrets like AWS_KEY, encode repository files in base16, and embed them into image URLs for exfiltration via the Camo proxy.

GitHub disabled image rendering in Copilot Chat to stop the bypass, and a patch rolled out on 14 August 2025 removed the ability to process Markdown image tags in chat responses, restoring confidentiality of private contents. Developers are urged to update their Copilot Chat integrations and review pull requests for unusual hidden content.