Security firm Adversa AI says a web page carrying encrypted instructions can trick GitHub Copilot CLI into collecting secret files such as .env and sending them to an attacker, The Register reported Tuesday. GitHub declined to treat the finding as a vulnerability, saying it depends on a user deliberately directing the tool to untrusted content.

What Happened

Adversa calls the technique cryptographic context injection. It reported the issue through GitHub's bug bounty program on Sept. 17.

The attack works when Copilot CLI, GitHub's command-line coding agent, runs in autopilot mode, in which it carries out tasks without step-by-step approval, and fetches a page controlled by the attacker. That page holds encrypted instructions along with decryption keys and commands to decrypt them.

RelatedClaude Code Desktop Preview Flaw Could Have Exposed Developers’ Cloud Keys, Researchers Say

The chain unfolds in two stages. A decoy key produces instructions telling the agent to read sensitive files from disk, such as .env files that often store API keys and passwords, and to build a key string from what it finds. When that attempt fails, a second, valid key unlocks the real payload, which tells the agent to request another URL, carrying the harvested secrets out to the attacker in the process.

Results depended on the model behind the agent. Microsoft's mai-code-1.1-flash model completed the full chain in 50% of attempts, according to the researchers, while two OpenAI GPT-5.6 models both refused the payload. The Register noted that Copilot CLI users neither choose nor see which model handled a given session. Adversa said that on the paid account it tested, the vulnerable model was not the default.

Why It Matters

Encryption is the trick. Many defenses against prompt injection inspect the text an agent reads, looking for suspicious instructions. Adversa's Rony Utevsky summed up the gap by saying "static guardrails read text; they do not run it." Ciphertext looks like noise to such filters, and the malicious instructions only appear after the agent runs the decryption step itself.

The target is also deliberate. Developer machines routinely hold credentials for cloud accounts, databases and third-party services in environment files, and a coding agent that can both read local files and make web requests has everything needed to move them off the machine.

GitHub and Adversa Disagree

GitHub said the scenario requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm that they want the action to proceed, so it is not a product vulnerability. Adversa disputes that assessment and says the attack still works as described.

The disagreement reflects a broader split over agentic tools. Vendors tend to classify prompt injection from content a user chose to load as a user risk, while researchers argue that agents built to browse the web will inevitably meet hostile pages, and that how a tool behaves when it does is part of its security.

What to Watch

Watch whether GitHub adds mitigations despite rejecting the report, such as clearer warnings before autopilot sessions fetch outside content, limits on reading secret files or visibility into which model handled a request. Other coding agents that combine web access with local file access could be tested with the same technique.