GitHub Copilot reproduces hardcoded secrets from training data (CUHK study)
Date: 2024-08
Affected: GitHub Copilot users
Attack vector: data-exfiltration
Category: real-world
Severity: High

Researchers from CUHK and Sun Yat-sen University extracted 2,702 hard-coded credentials from GitHub Copilot using a 'Hard-coded Credential Revealer' tool, showing Copilot can reproduce real secrets that leaked into its training data.


Mitigations:

Architectural layers (MAESTRO):