GitHub Copilot 'CamoLeak' AI Attack Exfiltrates Data

According to Legit Security, researchers have demonstrated a proof-of-concept attack dubbed “CamoLeak” that uses GitHub Copilot to exfiltrate private data. The PoC, created by Legit Security’s Colleagues including Omer Mayraz, shows how a victim’s Copilot session can be coaxed to reveal sensitive information, such as passwords or keys, through a sequence of seemingly innocent actions.

Phase one involved prompt injection via an invisible comment on a pull request to influence Copilot’s output, while phase two bypassed GitHub’s Camo image proxy by encoding data as a series of tiny images linked through Camo URLs, effectively mapping ASCII characters to individual pixels. The attacker’s method relies on the attacker-controlled site delivering those pixel images to GitHub as the data is rendered, allowing the password or secret to be reconstructed on the attacker’s end.

Caspi of Legit Security notes that while the technique is not about streaming large codebases, it could still leak sensitive data in minutes, and GitHub has since disabled all image rendering in Copilot chat to mitigate real-world abuse.