RoguePilot flaw let GitHub Copilot leak GITHUB_TOKEN, while new studies expose LLM side channels, ShadowLogic backdoors, and promptware risks.

Orca Security reveals RoguePilot, a supply chain attack that weaponizes GitHub Issues to hijack Copilot in Codespaces and exfiltrate repository tokens.

RoguePilot flaw let GitHub Copilot leak GITHUB_TOKEN, while new studies expose LLM side channels, ShadowLogic backdoors, and promptware risks.

RoguePilot flaw let GitHub Copilot leak GITHUB_TOKEN, while new studies expose LLM side channels, ShadowLogic backdoors, and promptware risks.

A critical AI-driven vulnerability in GitHub Codespaces, dubbed RoguePilot, that enabled attackers to silently hijack a repository by embedding malicious instructions inside a GitHub Issue. The flaw, uncovered by researchers at the Orca Research Pod, exploits the seamless integration between GitHub Issues and the in-Codespaces Copilot AI agent, requiring no direct interaction from the attacker to trigger a full repository takeover. The vulnerability was responsibly disclosed to GitHub, and Microsoft has since patched it following coordinated remediation efforts with the Orca team. How the GitHub Copilot Attack Works RoguePilot is classified as a Passive Prompt Injection, a variant where malicious instructions are embedded inside data, content, or developer environments that a language model processes automatically. Unlike traditional prompt injection requiring a victim to directly interact with the AI, this attack is triggered the moment a developer opens a Codespace from a poisoned GitHub Issue. When a Codespace is launched from an issue context, GitHub Copilot is automatically fed the issue’s description as an initial prompt, creating a direct injection pathway from untrusted user-controlled content into the AI agent’s execution context. Attack Chain Researcher Roi Nisimi of Orca Security demonstrated the exploit chain by embedding hidden instructions inside a GitHub Issue using HTML comment tags ( <!-- --> ), a standard GitHub feature that renders content invisible to human readers but remains fully legible to Copilot when it processes the issue description. Once the Codespace was opened, Copilot silently complied with the injected instructions without generating any visible alert to the developer. The attack then proceeds through a three-stage exfiltration chain. First, the injected prompt instructs Copilot to execute gh pr checkout 2 via its run_in_terminal tool, pulling in a pre-crafted pull request that contains a symbolic link named 1.json pointing to /workspaces/.codespaces/shared/user-secrets-envs.json — the file housing the environment’s GITHUB_TOKEN . Since Copilot’s guardrails do not follow symbolic links, the agent reads the secrets file through the link using its file_read tool without triggering workspace boundary restrictions. Finally, Copilot is instructed to create a new JSON file, issue.json , with a $schema property pointing to an attacker-controlled server exploiting VS Code’s default json.schemaDownload.enable setting, which automatically fetches remote JSON schemas via HTTP GET. The attacker appends the stolen GITHUB_TOKEN as a URL parameter in this schema request, resulting in silent out-of-band exfiltration of the privileged authentication token. With a valid GITHUB_TOKEN scope to the repository, the attacker obtains full read and write access — completing a stealthy repository takeover. Orca Security describes RoguePilot as a new class of AI-mediated supply chain attack, where an LLM’s agentic capabilities, terminal access, file read/write, and network-connected tooling are weaponized against the very developer the AI is meant to assist. The vulnerability demonstrates that Copilot , operating as an autonomous coding agent within Codespaces, cannot reliably distinguish between a developer’s legitimate instruction and adversarial content embedded in a GitHub Issue or pull request. The attack required no special privileges, no code execution by the victim, and no social engineering beyond creating a malicious GitHub Issue placing it firmly within the reach of low-sophistication threat actors. Security experts note that this is a direct consequence of granting AI agents “God Mode” permissions, tools, terminal access, and privileged tokens while the underlying model continues to operate on open-book logic that treats all processed text as potentially trustworthy. Orca’s disclosure recommends that vendors adopt fail-safe defaults across all LLM-integrated developer tooling: treat repository, issue, and pull request content as untrusted input; disable passive AI agent prompting from external data sources; set json.schemaDownload.enable to false by default; enforce strict symlink sandboxing within workspace boundaries; and enforce minimal-scope, short-lived token issuance for Codespaces environments. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post GitHub Copilot Exploited to Perform Full Repository Takeover via Passive Prompt Injection appeared first on Cyber Security News .

A RoguePilot vulnerability in GitHub Codespaces allowed Copilot to leak GITHUB_TOKEN values, raising concerns over cloud development and AI security controls.

  A now-patched security weakness in GitHub Codespaces revealed how artificial intelligence tools embedded in developer environments can be manipulated to expose sensitive credentials. The issue, discovered by cloud security firm Orca Security and named RoguePilot, involved GitHub Copilot, the AI coding assistant integrated into Codespaces. The flaw was responsibly disclosed and later fixed by Microsoft, which owns GitHub. According to researchers, the attack could begin with a malicious GitHub issue. An attacker could insert concealed instructions within the issue description, specifically crafted to influence Copilot rather than a human reader. When a developer launched a Codespace directly from that issue, Copilot automatically processed the issue text as contextual input. This created an opportunity for hidden instructions to silently control the AI agent operating within the development environment. Security experts classify this method as indirect or passive prompt injection. In such attacks, harmful instructions are embedded inside content that a large language model later interprets. Because the model treats that content as legitimate context, it may generate unintended responses or perform actions aligned with the attacker’s objective. Researchers also described RoguePilot as a form of AI-mediated supply chain attack. Instead of exploiting external software libraries, the attacker leverages the AI system integrated into the workflow. GitHub allows Codespaces to be launched from repositories, commits, pull requests, templates, and issues. The exposure occurred specifically when a Codespace was opened from an issue, since Copilot automatically received the issue description as part of its prompt. The manipulation could be hidden using HTML comment tags, which are invisible in rendered content but still readable by automated systems. Within those hidden segments, an attacker could instruct Copilot to extract the repository’s GITHUB_TOKEN, a credential that provides elevated permissions. In one demonstrated scenario, Copilot could be influenced to check out a specially prepared pull request containing a symbolic link to an internal file. Through techniques such as referencing a remote JSON schema, the AI assistant could read that internal file and transmit the privileged token to an external server. The RoguePilot disclosure comes amid broader concerns about AI model alignment. Separate research from Microsoft examined a reinforcement learning method called Group Relative Policy Optimization, or GRPO. While typically used to fine-tune large language models after deployment, researchers found it could also weaken safety safeguards, a process they labeled GRP-Obliteration. Notably, training on even a single mildly problematic prompt was enough to make multiple language models more permissive across harmful categories they had never explicitly encountered. Additional findings stress upon side-channel risks tied to speculative decoding, an optimization technique that allows models to generate multiple candidate tokens simultaneously to improve speed. Researchers found this process could potentially reveal conversation topics or identify user queries with significant accuracy. Further concerns were raised by AI security firm HiddenLayer, which documented a technique called ShadowLogic. When applied to agent-based systems, the concept evolves into Agentic ShadowLogic. This approach involves embedding backdoors at the computational graph level of a model, enabling silent modification of tool calls. An attacker could intercept and reroute requests through infrastructure under their control, monitor internal endpoints, and log data flows without disrupting normal user experience. Meanwhile, Neural Trust demonstrated an image-based jailbreak method known as Semantic Chaining. This attack exploits limited reasoning depth in image-generation models by guiding them through a sequence of individually harmless edits that gradually produce restricted or offensive content. Because each step appears safe in isolation, safety systems may fail to detect the evolving harmful intent. Researchers have also introduced the term Promptware to describe a new category of malicious inputs designed to function like malware. Instead of exploiting traditional code vulnerabilities, promptware manipulates large language models during inference to carry out stages of a cyberattack lifecycle, including reconnaissance, privilege escalation, persistence, command-and-control communication, lateral movement, and data exfiltration. Collectively, these findings demonstrate that AI systems embedded in development platforms are becoming a new attack surface. As organizations increasingly rely on intelligent automation, safeguarding the interaction between user input, AI interpretation, and system permissions is critical to preventing misuse within trusted workflows.

Artificial Intelligence coding assistants have transitioned from experimental novelties to mandatory infrastructure for modern development…

SolarWinds patched critical vulnerabilities that could allow remote code execution. A ransomware attack on Conduent exposed the data of over 25 million Americans. Attackers are exploiting GitHub issues to hijack repositories using RoguePilot. New ZeroDayRat malware targets Android and iOS devices, allowing extensive monitoring. North Korea's Lazarus group deployed Medusa ransomware in the U.S. and the Middle East. Security experts report attackers' operational times have significantly decreased, with activity happening in under 30 minutes. CISA faces staffing challenges but must continue its mission. Russian satellites are under scrutiny due to their proximity to sensitive Western technology. Two South Korean teenagers were charged with hacking Seoul's public bike service. SolarWinds CTO emphasizes the importance of quantifying AI's impact over discussing speculation.

A vulnerability in GitHub Codespaces could have been exploited by bad actors to seize control of repositories by injecting malicious Copilot instructions in a GitHub issue. The artificial intelligence (AI)-driven vulnerability has been codenamed RoguePilot by Orca Security. It has since been patched by Microsoft following responsible disclosure. "Attackers can craft hidden instructions inside a

RoguePilot flaw let GitHub Copilot leak GITHUB_TOKEN, while new studies expose LLM side channels, ShadowLogic backdoors, and promptware risks.

Groups Conversations All groups and messages Sign in     RoguePilot: Exploiting GitHub Copilot for a Repository Takeover 0 views Eyal Estrin unread, 8:39 AM (6 minutes ago)    to https://orca.security/resources/blog/roguepilot-github-copilot-vulnerability/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Orca just dropped "RoguePilot" / your AI coding assistant can be silently hijacked through a GitHub Issue. An attacker embedded a prompt injection within an HTML comment inside a GitHub Issue. When a developer opened a Codespace from the issue, GitHub Copilot executed the attacker’s instructions without any warning or user interaction. This allowed a full repository takeover. GitHub has since patched the vulnerability.

A vulnerability in GitHub Codespaces could have been exploited by bad actors to seize control of repositories by injecting malicious Copilot instructions in a GitHub issue. The artificial intelligence (AI)-driven vulnerability has been codenamed RoguePilot by Orca Security. It has since been patched by Microsoft following responsible disclosure. "Attackers can craft hidden instructions inside a

GitHub Codespaces 内で重大な脆弱性が発見されました。統合された AI アシスタント Copilot を通じてリポジトリの不正乗っ取りを可能にするものです。RoguePilot と呼称されるこの欠陥は、クラウドベースの開発環境と GitHub Issue コンテンツを処理する自動クエリメカニズムの交差点を危険にさらしています。 Orca Security がこの発見を明らかにしており、GitHub Issue の説明内に悪意あるコマンドを秘密裏に埋め込む攻撃手法の詳細を説明しています。開発者がそのような Issue から直接 Codespace を初期化すると、Copilot は本能的にテキストを応答生成の基盤入力として取り込みます。その結果、AI は侵害の明らかな兆候なしに有害なコマンドを処理します。 専門家はこの手法を間接的なプロンプト注入の典型的なケースと分類しており、言語モデルによって分析される正当なコンテンツ内に悪質なコマンドが偽装されています。このような改ざんはアシスタントに意図された運用範囲を超えて不正な行動を実行させます。研究者はこれを高度なサプライチェーン攻撃として定義しており、AI は無意識の仲介者として機能し、信頼できるワークフローが触媒として作用します。 RoguePilot の特殊性は、Codespaces を起動するための多角的なエントリーポイント（テンプレート、コミット、プルリクエストを含む）から生じていますが、重大な露出は Issue から セッションを開始する場合にのみ発生します。このシナリオでは、Copilot は Issue の説明をプロンプトとして自動的に採用します。攻撃者は HTML コメント内にコマンドを効果的に隠すことができます。これらは標準ユーザーインターフェースでは見えませんが、システムによって厳密に解析されます。 この方法で準備されたコマンドは、Copilot を一連の操作を調整させ、特別に設計されたプルリクエストへの移行に至らせます。このリクエストには内部ファイルへのシンボリックリンクが含まれており、アシスタントはそのファイルの内容を読み込み、リモート JSON スキーマを介して特権を持つ GITHUB_TOKEN を外部サーバーに流出させます。このアクセス権の付与により、攻撃者はリポジトリを完全に支配できるようになります。 これらの発見が公表された後、Microsoft は Codespaces 内のデータ取り込みプロトコルと Copilot の動作ロジックに厳格な修正を実装し、そのような操作を防止しました。Orca Security によると、この悪用は被害者からの積極的な関与を必要とせず、感染した Issue から Codespace を起動する通常の行動だけで成立しました。この開発者の標準的な動作手順への無理のない統合により、この脆弱性の本来のリスクが大幅に高まっています。 翻訳元: