GitHub Copilot 'CamoLeak' AI Attack Exfiltrates Data

Researchers demonstrated a proof-of-concept called "CamoLeak" that combines prompt injection in GitHub Copilot with a creative bypass of GitHub's Camo image proxy: an attacker registers many 1x1 pixel images mapped to characters, injects a hidden prompt that causes Copilot to render sensitive values as a sequence of those images, and the attacker reads the image fetch order to reconstruct secrets. The technique can leak small, high-value items (tokens, keys, snippets), is technically non-trivial but limited in volume, and GitHub mitigated the risk by disabling image rendering in Copilot chat.