2025-11-04 · 2025-Q4
GitHub Copilot Filename Prompt Injection
Primary layerL2 Instruction
Who actually said "do this"?
- Fixable
- Architectural
- Vendor response
- Not a vulnerability
- In the wild
- No
- Actor
- Attacker
Target
GitHub Copilot Chat (Agent mode)
Impact
Arbitrary instruction execution via extremely long filenames containing prompt injections; Microsoft declined to fix
Root cause
Copilot appends file names to user prompts without sanitization
Sources
Catalog
Cite this: AgentProv incident record: GitHub Copilot Filename Prompt Injection (2025-11-04). https://agentprov.com/incidents/2025-11-04-github-copilot-filename-prompt-injection
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction