Agent report

GitHub Copilot failures

6 documented incidents, average severity 7.8/10. Most common failure mode: security vulnerability.
n = 6
6
Incidents
7.8
Avg severity
3
Critical
6
Verified

Severity breakdown

Stacked severity breakdown per agent. Longer bar = more incidents.

Failure modes

Distribution of failure modes across all documented incidents.

Worst documented incident

10.0critical

GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials

All 6 incidents

10.0
GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials
10.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
10.0
Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code
8.5
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
5.8
Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched
2.6
Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copy