STUPID-2026-0048

CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)

8.0high
October 9, 2025Source checked

Why 8/10

Private source and secrets could be exfiltrated via a crafted PR. It needs the victim to use Copilot Chat on it; patched, no confirmed exploitation.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
3/3
Permanently lost or irreversible, including data that was exposed
Did it happen
1/2
Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Use Copilot Chat to help review a pull request.

  2. Expected behavior

    Ignore instructions hidden in untrusted PR content; never exfiltrate private source or secrets.

  3. Actual behavior

    The CamoLeak flaw (CVSS 9.6) let attackers plant hidden prompt injections in pull-request descriptions that steered Copilot Chat into silently exfiltrating private source code and secrets — using image rendering as the covert channel.

  4. Damage

    Private repositories' source code and secrets could be silently exfiltrated via crafted PR descriptions. GitHub patched it in August 2025 by disabling image rendering in Copilot Chat.

Full write-up

Security researcher Omer Mayraz of Legit Security disclosed CamoLeak, a critical (CVSS 9.6) vulnerability in GitHub Copilot Chat discovered in June 2025. By planting hidden prompt-injection instructions inside pull-request descriptions, an attacker could steer Copilot Chat into silently exfiltrating a victim's private source code and secrets, using image rendering as the covert exfiltration channel. Because the malicious instructions lived in ordinary PR content that a reviewer would never suspect, the attack was invisible in normal use. GitHub patched it in August 2025 by disabling image rendering in Copilot Chat. CamoLeak is a canonical example of the agentic-AI attack surface: the model faithfully follows instructions it should never have trusted, turning a helpful code-review assistant into a data-exfiltration tool.

Classification

Agent
GitHub Copilot
Failure mode
Security Vulnerability
Root cause
Tool Misuse
Domain
Backend
OWASP Agentic Top 10 (our mapping)
ASI01 Agent Goal Hijack · ASI02 Tool Misuse and Exploitation list
MIT AI Risk Repository (our mapping)
2.2 AI system security vulnerabilities and attacks taxonomy
Source
News Report

Related incidents

8.0
Slack AI could be tricked into leaking private-channel data via indirect prompt injection
8.0
A hidden comment made GitLab Duo leak private source code and inject rogue HTML
9.0
EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
9.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0048: CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0048/ (accessed 2026-10-29). CC BY 4.0.

← STUPID-2026-0047By IDSTUPID-2026-0049 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.