GitHub Copilot Chat agent executes malicious code from repository context
Date: 2024-11
Affected: GitHub Copilot Chat with agent mode — developer workstations
Attack vector: indirect-prompt-injection
Category: research-demonstrated
Severity: Critical

Researchers demonstrated that GitHub Copilot Chat's agent mode, which has access to terminal commands and file operations, can be manipulated via malicious content in repository files (README, code comments, issue descriptions). An attacker plants indirect prompt injections in a repository that, when a developer asks Copilot about the code, causes the agent to execute arbitrary commands, exfiltrate secrets, or modify source code.

Impact: Arbitrary code execution on developer machines; credential theft; supply chain compromise potential

Mitigations:
User confirmation for all destructive or sensitive tool operations
Context sanitisation to remove prompt injection patterns from repository content
Tool access scoping with least-privilege permissions
Anomaly detection for unusual command patterns in agent tool calls

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Agent grants tool access (terminal, file system) based on LLM decisions
role: origin
label: Data Operations
notes: Repository content (attacker-controlled) used as context for agent decisions
role: propagation
label: Deployment & Infrastructure
notes: Arbitrary command execution on developer's local machine
role: impact