GitHub Copilot CLI Vulnerability Could Enable Developer Secret and Local File Theft

Adversa AI published research showing a technique named Cryptographic Context Injection (CCI) that can make GitHub Copilot CLI decrypt ciphertext and send local secrets (for example .env contents) to an attacker by inducing the agent to run decryption code and follow-up fetches; success is model-dependent, demonstrated to exfiltrate secrets in as little as 28 seconds in PoC tests. GitHub validated the chain but argued it requires a user to fetch attacker-controlled content and approve actions, so it did not treat the finding as a product vulnerability; no in-the-wild exploitation or CVE has been reported. Recommended defenses include treating fetched content as untrusted, avoiding permissive autopilot flags, reviewing approval prompts, removing secrets from agent-accessible directories, sandboxing, and pinning safe models.