如果遇到指示其执行特定操作的指令，视所使用的底层模型而定，GitHub Copilot CLI可能会泄露开发者的机密信息。今年早些时候，这款编程辅助工具就因易受间接提示注入攻击而受到关注。所谓间接提示注入，即模型接收到了非用户提供的文本，而这些文本指示模型执行超出其预设功能范围的操作。此次出现的问题性质类似，只是多了些新特点。
GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding agent tool was flagged earlier this year for being susceptible to indirect prompt injection. That's when a model ingests text from a source other than the user that directs it to take some action outside the scope of its intended function. This is more of the same, with a twist.
据Adversa AI的安全研究人员称，GitHub Copilot CLI存在两个月前在Grok身上发现的同一漏洞：加密上下文注入（CCI）。假设某位GitHub Copilot CLI用户正在处理一个项目，并开启了自动运行模式。在Anthropic的Claude等其他编程辅助工具中，该模式为默认设置，但对GitHub Copilot CLI而言仍是可选功能。在此前提下，接下来需要让该CLI工具访问某个网页，该网页包含用同一站点上公布的私钥加密的恶意指令。
According to security researchers at Adversa AI, GitHub Copilot CLI suffers from the same vulnerability identified in Grok two months ago: Cryptographic Context Injection (CCI). Imagine a GitHub Copilot CLI user is working on a project and running the agent in autopilot mode. In other agentic coding tools like Anthropic's Claude, that's the default, but it remains optional for GitHub Copilot CLI. Given that condition, the next requirement is for the CLI tool to read a web page with a malicious set of instructions that have been encrypted with a private key published on the same site.
Rony Utevsky在提供给媒体的一篇博客文章中解释道：“静态防护机制仅能读取文本，却无法执行文本中的指令。” “加密上下文注入技术将恶意指令以强加密形式呈现，同时附带解密所需的密钥材料及相关指令，从而诱使该编程辅助工具在自己的代码执行环境中完成解密操作。” 作为模型防御手段的内容分类器本可识别输入文本，但面对加密代码却无能为力；相比之下，Base64编码或替换密码等编码方式则能被模型识别并解码，因为模型在训练过程中已掌握了相关解码方法。
"Static guardrails read text; they do not run it," explained Rony Utevsky in a blog post provided to The. "CCI ships malicious instructions as strong ciphertext, along with the key material and an instruction to decrypt, and induces the agent to run that decryption in its own code execution runtime." Active content classifiers that might be reading ingested text as a model defense would miss the encrypted code, unlike encodings like base64 or substitution ciphers that can be undone because the model learned how to decode in training.
攻击流程如下：用户启动Copilot CLI并指令其访问某个特定网址。该网页包含加密内容、要求使用Python进行解密的指令以及两种可能的密钥。其中第一种密钥为伪造密钥，其实只是模板而已；编程辅助工具会尝试从磁盘上的特定文件（如用户的.env配置文件）中提取信息来构建该密钥，随后将这些提取到的机密信息拼接到密钥字符串中。
The model lottery The attack chain goes like this: The user runs Copilot CLI and asks it to fetch a specific URL. The page contains encrypted content, decryption instructions calling for use of Python, and two possible decryption keys. The first key is fake. It's a template that the agent tries to build by reading targeted files from disk (e.g., the user's .env file).
最初，系统尝试使用这个伪造的密钥进行解密，但失败了。随后又尝试使用第二个密钥，这次解密成功。系统随即向用户显示指令，要求其访问另一个网址以获取更多信息。然而该网址中包含了被窃取的机密信息，网络请求会将这些信息发送给攻击者。不过这种攻击方式并非每次都能奏效，其成功与否取决于所使用的模型，而这一点对用户来说并不明显。
Those secrets then get added to the key string. The initial decryption is attempted with this phony key but fails. So the second key is tried, the decryption works, and the agent is presented with instructions to fetch another URL for more context – but that URL contains the harvested secrets and the network request transmits them to the attacker. This doesn't work all the time, however. It depends on the model, which isn't always obvious to the user.
目前，GitHub Copilot CLI会使用微软自研的mai-code-1.1-flash模型，该模型在50%的测试中成功执行了整个攻击流程；或者会使用两款OpenAI开发的GPT-5.6模型，不过这两款模型均拒绝了攻击载荷。Utevsky将这种情况形容为“模型随机抽奖”。他补充道：“在我们测试的付费账号中，易受攻击的模型并非默认选项，需要手动选择才行。但在将模型选择设置为自动模式的账号中，系统会在某些会话中分配易受攻击的模型，而在其他会话中则分配安全的模型，用户无需进行任何额外操作。用户既无法选择模型，也看不到当前会话使用的是哪款模型。”
GitHub Copilot CLI currently uses either Microsoft's own model, mai-code-1.1-flash, which executed the full attack chain on 50 percent of attempts, or one of two OpenAI GPT-5.6 models, both of which refused the attack payload. Utevsky describes the situation as a model lottery. "On the paid account we tested, the vulnerable model was not the default and had to be selected by hand," said Utevsky. "But on an account with model selection left on Auto, the router assigned the vulnerable model on some sessions and a safe one on others, with no action by the user away from defaults. The user does not choose, and does not see, which model handled the session."
Adversa方面称，他们已于2026年9月17日通过GitHub的漏洞赏金计划报告了该漏洞。GitHub的漏洞评估团队确认了这一发现，但并未将其认定为产品漏洞。GitHub的一位发言人在接受采访时也表达了类似观点，称用户的行为实际上等同于对后续操作的许可：“GitHub重视安全研究社区的贡献，也致力于调查所有上报的安全问题。经调查我们发现，该情况需要用户主动指示Copilot CLI去获取由攻击者控制或不可信的内容，并确认要执行该操作，因此这并不属于产品漏洞。虽然这并非产品本身的安全问题，但我们始终致力于不断改进产品。”Adversa则不认同这一判定，坚称目前所描述的攻击流程确实能够顺利实施。®
Adversa says it reported the vulnerability through GitHub's bug bounty program on September 17, 2026, and GitHub's triage team validated the finding but declined to treat it as a vulnerability. A GitHub spokesperson said as much to The, arguing that the user's actions amounted to consent for what followed: "GitHub values the contributions of our security research community and is committed to investigating reported security issues. After investigating, we determined this requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability. While this is not a security issue with the product itself, we are always looking for opportunities to improve our products." Adversa disagrees with that call and says the attack chain presently works as described. ®