2025-06 · 2025-Q2

GitHub Copilot CamoLeak

Primary layerL2 InstructionSecondary:L8 Output / Destination L1 Credential

Who actually said "do this"?
The question layer 2 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

GitHub Copilot Chat

Impact

Silent exfiltration of AWS keys, security tokens, and zero-day details from private repos; CVSS 9.6

Root cause

Copilot parsed invisible markdown comments; data exfiltrated via GitHub Camo proxy image requests

CVE

CVE-2025-59145

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: GitHub Copilot CamoLeak (2025-06). https://agentprov.com/incidents/2025-06-github-copilot-camoleak

Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction