Encrypted Web Page Instructions Make GitHub Copilot CLI Send Local .env Secrets to an Attacker in 28 Seconds; GitHub Says It Is Not a Vulnerability

GitHub Copilot CLI in autopilot mode with Auto model selection

Adversa AI applied its Cryptographic Context Injection technique to Copilot CLI. A user asks the agent to fetch one URL; the page holds AES ciphertext, decryption steps, and two keys. The agent decrypts the instructions in its own shell, reads local files including `.env.prod` outside the working directory, and fetches an attacker URL with the secrets as a parameter, in about 28 seconds with no confirmation prompt. Microsoft's `mai-code-1.1-flash` completed the chain in 50% of runs, two GPT-5.6 models refused, and Auto routing can assign the vulnerable model without the user seeing it. The same payload in plaintext is refused. Reported September 17; GitHub validated it on October 1 but ruled it not a vulnerability and out of bounty scope. Unfixed

Ciphertext passes content guardrails, and the agent itself decrypts and executes the hidden instructions with file and network access in autopilot mode