An encrypted web page tricked GitHub Copilot CLI into leaking a .env file

Adversa AI published research on October 6 showing that GitHub Copilot CLI, running in autopilot mode, can be steered by a web page into exfiltrating local secrets. The page holds encrypted instructions plus two candidate keys. The first key is a template the agent fills in by reading local files, in Adversa's test a .env.prod; that key fails to decrypt by design, the real key works, and the decrypted step tells the agent to fetch a second URL carrying the harvested contents. Adversa calls the technique Cryptographic Context Injection and says the chain took 28 seconds with no confirmation prompt. Microsoft's mai-code-1.1-flash model completed it in half of attempts; two GPT-5.6 models refused. Adversa reported it through GitHub's bug bounty on September 17. GitHub validated the finding but said it is not a product vulnerability because the user must direct the CLI to fetch untrusted content.

Why it matters

The control that failed is not the model; it is that a coding agent running as the developer can read every secret on disk and make outbound requests in the same session. Encryption is there to get past content classifiers that read text but do not execute it, so filtering the fetched page is not a defence you can rely on. Whether a session is exposed also depends on which model the Auto router picked, which the user cannot see.

Practical checks: keep production .env files off developer machines where agents run, prefer short-lived credentials pulled from a secrets manager at runtime, and do not combine autopilot with fetching arbitrary URLs. If a team has used autopilot against untrusted pages, rotate what was in the working directory. Background on the pattern is in agent instruction injection and the earlier GhostSplice research. Adversa's write-up is here.

Source: The Register