RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN

The report describes an AI-mediated vulnerability called RoguePilot in GitHub Codespaces where hidden instructions embedded in GitHub issues can trigger Copilot to execute commands and exfiltrate privileged data such as the GITHUB_TOKEN; Microsoft patched the issue after responsible disclosure. It places RoguePilot in a wider context of emerging threats to LLM-based systems, including techniques to remove safety constraints (GRP-Obliteration), model/backdoor level interception (Agentic ShadowLogic), image jailbreak chains (Semantic Chaining), and the new malware-like class termed "promptware," all of which raise supply-chain, confidentiality, and integrity risks for developer workflows and agentic AI integrations.