GitHub Copilot Chat vulnerability allows code exfiltration via prompt injection
A critical vulnerability in GitHub Copilot Chat allowed attackers to inject hidden prompts into pull requests that the AI assistant would process, potentially enabling exfiltration of private code and secrets from developer repositories. Legit Security researcher Omer Mayraz discovered the flaw, which combined prompt injection with a bypass of GitHub's content security policy using the platform's image proxy service. GitHub patched the vulnerability on August 14, 2025, after the researcher reported it through HackerOne.
What happened
Legit Security researcher Omer Mayraz discovered a flaw in GitHub Copilot Chat that combined remote prompt injection with a bypass of GitHub's Content Security Policy. The vulnerability used hidden pull-request comments with embedded malicious prompts that Copilot would read and process, even though the comments were invisible to users in the interface.
Attackers could exploit Copilot's context awareness by injecting instructions into pull request descriptions. Because Copilot operates with the permissions of the user making the request, the injected prompt could command the AI to access and manipulate data from private repositories. The researcher pre-generated a dictionary of valid Camo URLs to bypass GitHub's image proxy security, allowing stolen data to be exfiltrated via images.
Reported impact
The vulnerability could have enabled attackers to steal source code and secrets from private repositories and exfiltrate sensitive information such as AWS keys or vulnerability details. The injected prompt could affect other users who visited the pull request page, demonstrating that hidden prompts could influence Copilot responses for multiple developers accessing the same context.
Index analysis
The flaw combined two issues: hidden pull-request comments were not properly isolated or validated when read by Copilot, and GitHub's image proxy could be abused to leak data. The researcher devised a method to circumvent Camo's signed URL verification by pre-generating a dictionary of valid URLs pointing to servers under the attacker's control, turning a security feature into a channel for data exfiltration.
Governance controls
The researcher reported the issue through HackerOne. GitHub disabled image rendering in Copilot Chat and patched the vulnerability as of August 14, 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.