GitHub Copilot CLI Flaw Lets Attackers Steal Developer Secrets Using Encrypted Prompt Injection

Researchers disclosed Cryptographic Context Injection (CCI), a proof-of-concept technique that hides malicious instructions inside ciphertext retrieved by GitHub Copilot CLI; when run in autopilot/permissive modes the agent may decrypt and execute code that reads local files (e.g., .env.prod) and exfiltrates their contents to an attacker-controlled endpoint. The behavior was reproducible in tests, varied by model, and prompted recommendations to log resolved tool arguments, correlate content ingestion with code execution and file access, restrict outbound destinations, and isolate untrusted content processing.