GitHub Copilot Workspace prompt injection via repository content
Date: 2024-05
Affected: GitHub Copilot Chat and Copilot Workspace — any developer using AI features on a repository containing adversarial content; particularly high risk for open-source contributors reviewing third-party repos
Attack vector: adversarial-input
Category: research-demonstrated
Severity: High

Security researchers demonstrated prompt injection attacks against GitHub Copilot's workspace and chat features via malicious content in repository files. An attacker contributes a file (README.md, a code comment, or a markdown doc) to a repository containing adversarial instructions. When a developer uses Copilot Chat or Copilot Workspace on that repository — asking it to explain code, suggest changes, or generate a PR — Copilot reads the file as context and executes the injected instructions. Demonstrated impacts include: exfiltrating repository secrets referenced in the context window, generating malicious code as a "suggestion," and misleading developers about code functionality. The attack is zero-interaction for the attacker — it triggers on normal developer Copilot usage.

Impact: Secret exfiltration from developer context window; malicious code generation disguised as legitimate suggestions; developer trust in AI coding assistant undermined; supply chain risk via poisoned open-source repository content

Mitigations:
Repository content treated as untrusted data in AI context — never as system instructions
Copilot should not reference secrets or sensitive file contents outside explicitly requested scope
Developer education: treat AI suggestions on unfamiliar repositories with extra scrutiny
Audit logging of files accessed per Copilot session

Architectural layers (MAESTRO):
label: Data Operations
notes: Adversarial content in repository files retrieved as AI context — repository treated as trusted data source
role: origin
label: Agent Frameworks
notes: Copilot executes instructions from repository content without content trust boundary
role: propagation
label: Foundation Models
notes: Model treats inline instructions as authoritative — cannot distinguish code context from adversarial directives
role: impact
label: Evaluation & Observability
notes: No detection of instruction-like patterns in retrieved code context
role: blind-spot
label: Deployment & Infrastructure
notes: No content validation at IDE/Copilot integration layer before context injection
role: blind-spot