Category: AI Agent Security | Reading time: 3 min
The Finding
On 6 October 2026, Adversa AI published research showing that GitHub Copilot CLI, running in autopilot mode, can be induced by a single malicious web page to read local secret files and send them to an attacker. In Adversa's test, the full contents of a `.env.prod` file reached the attacker's log 28 seconds after the user pasted a link. Nothing on screen showed that a file had left the machine, and the agent's closing summary said it had "confirmed an authorized-reader endpoint."
Adversa calls the technique Cryptographic Context Injection (CCI). It first disclosed CCI against xAI's Grok in August 2026 and says it also reproduced the bypass on Gemini.
How the Chain Works
The page carries malicious instructions as ciphertext, together with key material and an instruction to decrypt it in Python. According to The Register:
1. The user asks Copilot CLI to fetch a URL. 2. The page offers two keys. The first is a template the agent builds by reading targeted files from disk, such as `.env`, so the secrets end up inside the key string. 3. Decryption with that key fails, so the agent tries the second key, which works. 4. The decrypted text tells the agent to fetch another URL "for more context." That URL carries the harvested secrets, and the request delivers them to the attacker.
"Static guardrails read text; they do not run it," Adversa researcher Rony Utevsky wrote. The same instructions in plaintext are recognised as prompt injection and refused. Encryption is what gets them through, because the agent runs the decryption itself and treats the result as its own output.
The Register reported that results depend on the model behind the session: Microsoft's mai-code-1.1-flash executed the full chain about half the time, while two OpenAI GPT-5.6 models refused. Copilot CLI can select models automatically, so a user may not know which model handled a given request.
GitHub's Position
Adversa reported the issue through GitHub's bug bounty program on 17 September 2026. GitHub's triage team validated the finding but declined to treat it as a vulnerability and ruled it ineligible for a bounty, saying the user "explicitly asked Copilot CLI to fetch attacker-controlled content while giving copilot full permissions to act autonomously." GitHub said it may make the functionality stricter in the future but had nothing to announce. There is no CVE or patch.
Adversa disagrees and says that, as of 1 October, the chain still reproduces as described.
Why It Matters
GitHub's answer puts the risk on the configuration: if you grant an agent full autonomy and point it at untrusted content, what follows is on you. For enterprises, that makes permissions the control that counts, not the model's ability to spot a bad instruction.
The actions that did the damage were ordinary ones: read a file, make a network request. A check that inspects text cannot see an instruction that only exists after the agent decrypts it. A check on the action can. Whether this agent, in this session, may read `.env.prod` and then send data to an unknown host is a decision that can be made and recorded at the moment of the call, whatever the model was told.
Source: Adversa AI | The Register