GitHub Copilot activated in private workspaces without user consent
A developer reported that GitHub Copilot activated automatically across all his private workspaces without consent, exposing sensitive client code and credentials that could have been sent to external servers. The incident highlights concerns about consent management in AI development tools.
What happened
A developer reported that GitHub Copilot activated automatically in private local workspaces without explicit user consent. The developer had configured Copilot to function only in specific files or public workspaces, but the tool activated across all development environments including private ones.
The developer stated that sensitive data in private repositories—including API keys, secrets, YAML configurations, and certificates—could have been sent to external servers without authorization or user notification.
Reported impact
The unauthorized activation exposed sensitive client code and security credentials in private workspaces where the developer had not granted Copilot permission. The developer indicated that some repositories belong to clients who did not consent to sharing code with third parties.
Index analysis
The incident raises concerns about AI tool consent management in development environments and the handling of sensitive data in private projects.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.