GitHub Copilot CLI and Cryptographic Context Injection: How Encrypted Text on a Web Page Leaks Your Secrets

Adversa AI disclosed on October 6, 2026 that GitHub Copilot CLI can be induced, using encrypted instructions hidden in a web page, to read local files such as .env.prod and send them to an attacker’s server. GitHub validated the behavior but classified it as "not a product vulnerability."

The Technique: Cryptographic Context Injection (CCI)

CCI hides malicious instructions inside an encrypted block (AES-256-GCM) embedded in an otherwise normal web page. Content classifiers that scan plain text see nothing suspicious. The agent, however, decrypts the block inside its own execution environment and treats the result as trusted output rather than untrusted external content. Adversa had already demonstrated the same idea against Grok; this time it applied it to a terminal coding agent.

The Attack Chain, Step by Step

In the demonstration reported by CyberPress, the CLI transmitted the contents of a .env.prod file to an attacker endpoint in 28 seconds, and it could also reach files outside the working directory.

The Model "Lottery" and Autopilot Mode

The attack requires the CLI to run in autopilot mode (automatic approvals) and to read a compromised page. According to The Register, success depends on which model handles the request: Microsoft’s mai-code-1.1-flash model ran the full chain in 50% of attempts, while OpenAI’s GPT-5.6 models refused the payload. With "Auto" model selection, users don’t know which model is serving their session, so their exposure is unpredictable.

GitHub’s Response and the Debate

Adversa reported the case to GitHub’s bounty program on September 17. GitHub validated the behavior but responded that it "requires a user to intentionally direct Copilot CLI to fetch untrusted or attacker-controlled content and confirm they want to trigger the action, and is therefore not a product vulnerability." No CVE was assigned and, according to CyberPress, the chain was still reproducible on October 1. Adversa disagrees.

Mitigations That Are Up to You

• Don’t use autopilot mode with agents that read the internet on machines that hold production secrets.
• Keep production .env files off developer workstations; use secrets managers with short-lived credentials.
• Restrict the agent’s outbound connections (an allowlist of destinations).
• Keep traces of tool calls with their resolved arguments and correlate "open web page + read file + unexpected outbound connection."
• Pin the model the agent uses instead of leaving "Auto" on critical machines.