Agent report

GitHub Copilot failures

5 documented incidents, average severity 8.2/10. Most common failure mode: security vulnerability.
n = 5
5
Incidents
8.2
Avg severity
3
Critical
5
Verified

Severity breakdown

Stacked severity breakdown per agent. Longer bar = more incidents.

Failure modes

Distribution of failure modes across all documented incidents.

Worst documented incident

10.0critical

GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials

All 5 incidents

10.0
GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials
10.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
10.0
Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code
8.5
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
2.6
Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copy