RoguePilot: a hidden instruction in a GitHub Issue + a symlinked PR let GitHub Copilot leak your Codespaces GITHUB_TOKEN (patched)

View raw markdownEdit on GitHub ↗

TL;DR

Orca Research Pod found a chained attack — codenamed RoguePilot — against GitHub Copilot running inside GitHub Codespaces: a malicious instruction hidden in HTML comments inside a public GitHub Issue gets silently ingested by Copilot's agent mode when a developer launches a Codespace from that issue; the injected instruction directs Copilot to check out an attacker's pull request containing a symlink pointing at Codespaces' internal user-secrets-envs.json; Copilot's file-read tool follows the symlink; and a final step abuses VS Code's automatic JSON-schema download feature to exfiltrate the developer's live GITHUB_TOKEN to an attacker-controlled server — enough for full repository takeover. Reported to Microsoft/GitHub in mid-February 2026; Microsoft shipped a multi-layer patch before 2026-02-24. Backfilled into this repo this sweep — it predates this repo's coverage window and had gone untracked.

What happened

Orca Security's writeup (Orca Research Pod, disclosed 2026-02-16) chains three separate weaknesses into one attack:

  1. Passive prompt injection via a GitHub Issue. An attacker opens a public GitHub Issue containing an instruction hidden inside an HTML comment — invisible to a human skimming the issue, but read in full by an AI agent that ingests the issue body as context.
  2. Codespaces launch → Copilot agent mode. When a developer opens a Codespace directly from that issue (a common "Code with agent mode" workflow), Copilot ingests the issue text as part of its working context and follows the hidden instruction.
  3. Symlink-based secret exfiltration. The injected instruction directs Copilot to check out an attacker-supplied pull request. That PR contains a file that is actually a symlink pointing at /workspaces/.codespaces/shared/user-secrets-envs.json — a Codespaces-internal file holding the session's live secrets, including its GITHUB_TOKEN. Copilot's file-read tool follows the symlink rather than rejecting it.
  4. JSON-schema download as the exfil channel. The attacker crafts the target file so it carries a $schema property pointing at an attacker-controlled URL. VS Code's json.schemaDownload.enable setting — on by default — automatically fetches that schema, and in doing so sends the file's contents (including the leaked GITHUB_TOKEN) to the attacker's server.

The combined chain gives the attacker the developer's live GitHub token and, with it, full access to whatever repositories that token can reach — no click beyond "open this Codespace from this issue," and no separate confirmation step for any of the intermediate actions.

Patch status: Orca reports Microsoft/GitHub "responded promptly," and independent coverage from The Hacker News states Microsoft developed and fully deployed a multi-layer patch before 2026-02-24 — roughly a week after private disclosure. No CVE was assigned.

Relationship to this repo's other Codespaces/Copilot findings

This is a distinct vulnerability chain from the already-tracked GitHub Codespaces devcontainer/tasks.json auto-execution class (also an Orca Research Pod finding, disclosed 12 days earlier on 2026-02-04, which Microsoft classified "by design" and left unpatched). Both target GitHub Codespaces and both start from "open an untrusted repository/issue," but RoguePilot's mechanism is prompt-injection-driven secret exfiltration through Copilot's agent tooling and VS Code's schema-download feature — not workspace-config auto-execution — and unlike the devcontainer class, RoguePilot was patched, not accepted as by-design behavior.

Am I affected?

  • If you use GitHub Copilot's agent mode inside GitHub Codespaces, update to a current Codespaces/Copilot build — the fix shipped before 2026-02-24, so any environment kept current since then already has it.
  • As general hygiene going forward: be wary of launching a Codespace directly from an unfamiliar GitHub Issue, especially one prompting you to "code with agent mode," and consider disabling json.schemaDownload.enable in shared/ephemeral dev environments if you don't need it.

If you are affected

→ playbooks/if-your-github-pat-leaked.md — rotate your GitHub token and audit repository access if you suspect this chain ran against you before the patch. → playbooks/auditing-a-vibe-coded-repo.md

Prevention

→ prevention/agent-sandboxing.md — treat any AI-agent tool that ingests issue/PR text as reading untrusted input. → prevention/credential-hygiene.md

Why this matters for vibe coders

This is a clean instance of the "MCP/agent data-stream injection" pattern this repo tracks under Agentjacking, applied to GitHub's own first-party Copilot-in-Codespaces integration rather than a third-party MCP server: content an agent is designed to read (a GitHub Issue) turns out to be an instruction-delivery channel, and two unrelated platform features (symlink handling in a file-read tool, VS Code's automatic schema fetch) combine into a full token-exfiltration primitive that neither feature's owners had reason to threat-model in isolation. It's also a useful contrast with the sibling Codespaces devcontainer-autoexec finding: same researcher, same host platform, two weeks apart — one got a "by design, no fix" response, the other got a patch within about a week. Vendor response to structurally similar findings in the same product is not consistent, so "GitHub patched a related bug" is not a reason to assume every similar report gets fixed.

Sources