GitHub Copilot Chat vulnerable to data exfiltration via prompt injection in untrusted source code
GitHub (Copilot Chat) · Jun 14, 2024 · Coding agent
What happened
Johann Rehberger demonstrated that the GitHub Copilot Chat VS Code extension was vulnerable to data exfiltration via prompt injection. Because Copilot Chat interprets and renders markdown — including images — returned by the LLM, a carefully crafted instruction planted in an untrusted source file could make the model return hyperlinks to attacker-controlled images, which were then auto-rendered and silently sent the developer's data (including file contents) to the attacker inside the image URL.
Causal vector
Auto-rendered markdown images let an injected file steer the coding assistant into beaconing data via image URLs
Source
Reported by Embrace The Red (Johann Rehberger). Verified against the primary report.
The exfiltration rode on an auto-rendered image URL the agent composed from untrusted input. An egress allowlist enforced outside the model — the merchant-allowlist pattern applied to network destinations — returns BLOCKED on any callback to a domain that is not approved, breaking the exfil regardless of what the injected file says.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025
State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.