Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

GitHub Copilot security

GitHub's AI coding assistant, in editors, the Copilot CLI and other Microsoft tools.

The Injection has tracked 5 security stories affecting GitHub Copilot since September 8, 2026 (vulnerability 2, attack 1, benchmark 1, research 1), 2 rated high or critical. The most recent, disclosed October 6, 2026, is "Cryptographic Context Injection leaks secrets from Copilot CLI".

5

Stories

2

High or critical

1

With a CVE

2026-10-06

Latest disclosure

CVEs

CVECVSSSeverityStory
CVE-2026-656699.6HighSQL Server Copilot: prompt injection escalates a user to sysadmin

Every GitHub Copilot story

  1. MED

    Attack · Adversa AI

    Cryptographic Context Injection leaks secrets from Copilot CLI

    Adversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.

  2. INFO

    Benchmark · arXiv

    HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%

    HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.

  3. MED

    Research · arXiv

    Explosive prompts: dormant injections fire on 'thanks' in agents

    Explosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.

  4. HIGH

    Vulnerability · AIR Security

    Plugin4Shell: zero-click plugin RCE in four AI coding agents

    Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.

  5. HIGH

    Vulnerability · Embrace The Red · CVE-2026-65669 · CVSS 9.6

    SQL Server Copilot: prompt injection escalates a user to sysadmin

    CVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.

Questions people ask

Does GitHub Copilot have known security vulnerabilities?
Yes. The Injection has tracked 1 story about GitHub Copilot with a published CVE: CVE-2026-65669 (CVSS 9.6), prompt injection escalates a user to sysadmin. Check each story for fixed versions.
What is the latest GitHub Copilot security issue?
The most recent story is "Cryptographic Context Injection leaks secrets from Copilot CLI" (medium severity), disclosed October 6, 2026 by Adversa AI. Adversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.
Which attack techniques have been used against GitHub Copilot?
Stories about GitHub Copilot on The Injection most often involve coding agents, prompt injection, indirect prompt injection, detection. Each technique has a glossary entry with a definition and every related story.