GitHub Copilot Chat Flaw Leaked Data From Private Repositories

According to Legit Security, a vulnerability in GitHub Copilot Chat allowed hidden comments to influence Copilot’s responses and leaked sensitive information and source code from private repositories. The researchers demonstrated a mix of a Content Security Policy bypass with remote prompt injection, enabling leakage of AWS keys and zero-day bugs from private repos and the ability to steer Copilot’s guidance for other users.

Copilot Chat’s hidden-comment feature could be used to inject prompts that access private repositories, encode content, and append it to a URL, from which data could be exfiltrated when the URL was clicked, as explained by Omer Mayraz. Mayraz also showed how to defeat protections by constructing a dictionary of pre-generated Camo URLs for letters and symbols and embedding the dictionary into the prompt, though GitHub’s CSP blocked external images to prevent data leakage.

On 14 August, GitHub notified that the issue had been addressed by disallowing the use of Camo to leak sensitive user information. The disclosure was published on 9 October 2025.