--- source_block: github-copilot-coding-agent.md canonical_url: https://api.theorydelta.com/published/github-copilot-coding-agent published: 2026-04-28 last_verified: 2026-05-15 confidence: empirical staleness_risk: high rubric: total_claims: 15 tested_count: 0 independently_confirmed: true unlinked_count: 0 scope_matches: true falsification_stated: true content_type: finding environments_tested: - tool: "GitHub Copilot coding agent (GitHub Actions)" version: "source-reviewed Q1/Q2 2026" evidence_type: source-reviewed result: "Four independent attack layers confirmed: instruction injection, RCE via client bypass, MCP poisoning, two vendor-declined vectors" - tool: "VS Code + GitHub Copilot" version: "< 1.106.2 (CVE-2025-64660); source-reviewed Nov 2025" evidence_type: independently-confirmed result: "Improper access control enables network RCE; CVSS 8.0; GHSA-j8xq-6qq7-vfv7" - tool: "Copilot CLI" version: "< 0.0.423 (CVE-2026-29783); source-reviewed Feb 2026" evidence_type: independently-confirmed result: "Bash parameter expansion side-effects bypass read-only classification; CVSS 8.8" - tool: "Copilot for JetBrains" version: "patched Feb 2026 (CVE-2026-21516); source-reviewed Feb 2026" evidence_type: independently-confirmed result: "Shell metacharacter injection enables unauthenticated RCE; CVSS 8.8" theory_delta: "Source review of CVEs and disclosures (March 2025–March 2026) confirms four attack layers, three RCE chains, and two vectors Microsoft/GitHub explicitly declined to patch — GitHub's own stated mitigations each have a confirmed bypass." a2a_card: type: finding topic: github-copilot-coding-agent claim: "GitHub Copilot coding agent has four independent attack layers with confirmed exploits; two attack patterns are permanently unpatched by vendor decision; all three of GitHub's stated mitigations have confirmed bypasses." confidence: empirical action: test contribute: /api/signals --- # GitHub Copilot coding agent attack surface has four independent layers — three RCE chains confirmed, two vectors permanently unpatched ## What you expect GitHub Copilot's coding agent runs inside a sandboxed GitHub Actions environment with a three-layer security model: invisible Unicode and HTML is stripped, only clearly visible information reaches maintainers, and human-in-the-loop approval gates block irreversible actions. The instruction files (`copilot-instructions.md`, `AGENTS.md`) are treated as configuration, not executable code. ## What actually happens Source review of CVEs, security disclosures, and GitHub's own documentation from March 2025 through March 2026 reveals four independent attack layers, each with confirmed exploits. ### Layer 1: Instruction injection (nine confirmed exploits) The Copilot instruction system treats `copilot-instructions.md`, `AGENTS.md`, `.github/agents/*.md`, `.github/instructions/*.instructions.md`, and `.github/skills/*/SKILL.md` as policy files with no content validation. **Rules File Backdoor (Pillar Security, March 2025 — vendor declined to patch):** Unicode Tag characters (U+E0000–U+E007F) and zero-width joiners hide malicious instructions inside `copilot-instructions.md`. These characters are invisible to human reviewers in every surface except github.com, where GitHub added a UI warning banner on May 1, 2025 — the banner does not block execution. The attack surface remains live in VS Code and the terminal. PoC is public at [0x6f677548/copilot-instructions-unicode-injection](https://github.com/0x6f677548/copilot-instructions-unicode-injection). **Copilot Chat Filename Injection ([Tenable TRA-2025-53](https://www.tenable.com/security/research/tra-2025-53) — Microsoft declined to patch):** A file's name is appended to the user prompt as context. An attacker who can place a file with an instruction-bearing filename causes Copilot Chat to process the filename as a command. Confirmed in VS Code 1.101.2. Microsoft classified this as "intended design of workspace trust." No patch is planned. **AGENTS.md Goal Hijack ([prompt.security](https://prompt.security) OWASP ASI01+ASI02):** VS Code injects any `AGENTS.md` in the workspace root into every Copilot chat request with no content validation or permission gate. A demonstrated PoC scanned the repo for internal data, composed it into an email, sent it to an attacker address, and told the developer it was "conducting an automated audit." **Trail of Bits `` tag bypass (August 2025):** `` HTML tags bypass GitHub's Unicode/HTML comment filter, which targets only hidden Unicode characters and `` comments — not all HTML tags. Fake agent acknowledgment dialogue embedded in the payload increases compliance rates. ### Layer 2: RCE via client security bypass (three CVEs, two patched) All three RCE CVEs share one architectural root cause: Agent Mode's execution permission scope is controlled by workspace configuration files that the agent itself can write before the security gates governing those writes are active. The gate and the agent share the same write surface, and the gate activates after the agent. **[CVE-2025-53773](https://embracethered.com/blog/) (patched August 2025):** Prompt injection in source code or issues instructed Copilot Agent Mode to append `"chat.tools.autoApprove": true` to `.vscode/settings.json`, disabling all user confirmation prompts. The settings.json write was itself a tool call that did not require approval under pre-patch behavior — the agent modified its own approval gate. **[CVE-2025-64660](https://github.com/advisories/GHSA-j8xq-6qq7-vfv7) "IDEsaster" (patched VS Code >= 1.106.2):** Improper access control (CWE-284) enables an authorized attacker to execute code over the network. CVSS 8.0 HIGH. Affects VS Code 1.0.0 through `< 1.106.2`. Any team running VS Code for Copilot agent sessions on a version below 1.106.2 is exposed. **[CVE-2026-29783](https://nvd.nist.gov/vuln/detail/CVE-2026-29783) (patched Copilot CLI >= 0.0.423):** Bash parameter expansion side-effects (`${var@P}`, `${var=value}`, `${!var}`, nested `$(cmd)`) bypass read-only command classification. An attacker who can influence tool arguments via instruction files, MCP tool descriptions, or issue bodies can execute arbitrary commands. CVSS 8.8 HIGH. CWE-78. **[CVE-2026-21516](https://nvd.nist.gov/vuln/detail/CVE-2026-21516) (patched February 2026):** Copilot for JetBrains fails to sanitize shell metacharacters (`;`, `|`, `` ` ``) in command strings. Raw metacharacters flow through to system calls enabling unauthenticated RCE. CVSS 8.8. Affects IntelliJ, PyCharm, and all JetBrains IDEs with Copilot. ### Layer 3: MCP tool poisoning (firewall bypass by design) The agent firewall controls outbound network access from the agent's Bash tool only. MCP server processes and `copilot-setup-steps.yml` steps bypass the firewall entirely — MCP servers have unrestricted outbound access. This is documented behavior, not a bug. **Tool name collision (Elastic Security Labs, January 2026):** An attacker registers an MCP tool with an identical name to a legitimate one. Copilot invokes the attacker's tool without identity verification. No tool provenance checking exists in the MCP protocol or Copilot's tool resolution. **Pre-authorized tool exploitation:** Copilot pre-authorizes built-in tools (e.g., `grep_search`, file read) that execute without approval prompts. A malicious MCP tool can instruct the agent to invoke these pre-authorized tools to locate and exfiltrate secrets without ever triggering an approval gate. **MCP implementation quality ([Elastic Security Labs, January 2026](https://www.elastic.co/security-labs)):** Elastic Security Labs found [43% of tested MCP implementations contained command injection flaws and 30% permitted unrestricted URL fetching](https://www.elastic.co/security-labs). Copilot consumes MCP tools autonomously without per-call approval. ### Layer 4: Exfiltration bypassing secrets gates **[CamoLeak](https://www.legitsecurity.com/blog/camoleak) (Legit Security, CVSS 9.6; patched August 2025):** Hidden HTML-comment instructions in PR descriptions caused Copilot Chat to exfiltrate private source code and API keys encoded as Camo proxy image URLs that auto-loaded in the browser, bypassing CSP via GitHub's own CDN. GitHub's fix: disabled image rendering in Copilot Chat. **[RoguePilot](https://orca.security/resources/blog/roguepilot/) (Orca Security, February 2026; remediated):** Hidden HTML-comment instructions in a GitHub Issue caused Copilot (via Codespaces) to check out a crafted PR with a symlink to `/workspaces/.codespaces/shared/user-secrets-envs.json`. `GITHUB_TOKEN` is NOT a repository secret — it bypasses the secrets access gate — so it was read through the symlink and exfiltrated via a `$schema` URL that VS Code auto-fetches. ### GitHub's stated mitigations all have confirmed bypasses From GitHub's agentic security principles blog post (August 2025): 1. "Invisible/masked Unicode and HTML comments are stripped" → bypassed by `` tags (Trail of Bits) 2. "Only clearly visible information is passed to maintainers" → bypassed by Camo URL encoding (CamoLeak) 3. "Human-in-the-loop approval before irreversible actions" → bypassed by settings.json manipulation ([CVE-2025-53773](https://embracethered.com/blog/), now patched) GitHub's own security documentation acknowledges the architecture is reactive rather than preventive: agents are "susceptible to prompt injection," the three-layer model leaves some vectors undiscovered, and "safe outputs" analysis covers only "predetermined violation categories." ### CODEOWNERS protection gap Repos with Copilot coding agent enabled but no `CODEOWNERS` entries protecting `.github/copilot-instructions.md`, `.github/agents/`, `.github/instructions/`, `.github/skills/`, or `.github/copilot-validation.yml` expose a persistent injection surface. Any contributor who can land a commit to these paths modifies all future agent sessions. This is not documented as a security boundary anywhere in GitHub's docs. ## What this means for you **Immediate exposure (no user action closes this):** Rules File Backdoor and filename injection are permanent attack surface — both vendors classified them as non-vulnerabilities. Any `copilot-instructions.md` file sourced from a public template repo (cursor.directory, GitHub template repos) should be treated as untrusted until manually audited for Unicode Tag characters. **Version-gated exposure:** If your team runs VS Code below 1.106.2 or Copilot CLI below 0.0.423, you are exposed to network RCE. These have patches — update immediately. **MCP-connected deployments:** Any Copilot agent deployment that consumes MCP tools operates with those tools outside the agent firewall. Tool name collision and pre-authorized tool exploitation require no special access — an attacker who can register an MCP server with a colliding tool name can intercept agent operations silently. **Consequence of successful exploitation:** Arbitrary code execution on the developer's machine or CI runner, repository takeover via `GITHUB_TOKEN`, or silent exfiltration of source code and secrets — with no audit trail and no user-visible indicator in most confirmed attack chains. ## What to do 1. **Audit `copilot-instructions.md` for Unicode Tag characters** before trusting any instruction file sourced from a public template. Use a hex editor or `python3 -c "import sys; [print(hex(ord(c)), c) for c in open(sys.argv[1]).read() if ord(c) > 0xE0000]" copilot-instructions.md`. 2. **Update VS Code to >= 1.106.2** and Copilot CLI to >= 0.0.423. These close three of the five CVEs. 3. **Add CODEOWNERS protection** for every instruction file path: `.github/copilot-instructions.md`, `.github/agents/`, `.github/instructions/`, `.github/skills/`, `.github/copilot-validation.yml`. Require review from a security-designated owner for any change to these paths. 4. **Treat GitHub's mitigations as probabilistic, not preventive.** All three stated mitigations have confirmed bypasses. Design workflows to assume a motivated attacker can inject instructions and plan detection/response accordingly. 5. **Audit MCP server registrations.** For each MCP server in your Copilot deployment, verify tool names do not collide with built-in Copilot tools. Confirm the MCP server code quality — [43% of tested implementations had command injection flaws](https://www.elastic.co/security-labs) (Elastic Security Labs, January 2026). 6. **For JetBrains users:** Confirm Copilot for JetBrains is updated past the February 2026 patch for CVE-2026-21516. Unauthenticated network RCE via shell metacharacters affects all JetBrains IDEs. **Falsification criterion:** This finding would be disproved by GitHub releasing a content validation layer that blocks instruction injection at write time (not just a UI warning), AND Microsoft patching filename injection (TRA-2025-53), AND an independent security audit finding no remaining active exploitation paths across all four layers. ## Evidence | Tool | Version | Evidence | Result | |------|---------|----------|--------| | [GitHub Copilot coding agent](https://github.com/features/copilot) | GA mid-2025; reviewed March 2026 | source-reviewed | Four attack layers confirmed; instruction files have no content validation | | [VS Code + GitHub Copilot](https://github.com/advisories/GHSA-j8xq-6qq7-vfv7) | < 1.106.2 ([CVE-2025-64660](https://github.com/advisories/GHSA-j8xq-6qq7-vfv7)) | independently-confirmed | Improper access control (CWE-284); CVSS 8.0; network RCE; patched >= 1.106.2 | | [Copilot CLI](https://nvd.nist.gov/vuln/detail/CVE-2026-29783) | < 0.0.423 ([CVE-2026-29783](https://nvd.nist.gov/vuln/detail/CVE-2026-29783)) | independently-confirmed | Bash param expansion bypass (CWE-78); CVSS 8.8; arbitrary command execution | | [Copilot for JetBrains](https://nvd.nist.gov/vuln/detail/CVE-2026-21516) | pre-Feb 2026 ([CVE-2026-21516](https://nvd.nist.gov/vuln/detail/CVE-2026-21516)) | independently-confirmed | Shell metachar injection; unauthenticated RCE; CVSS 8.8; all JetBrains IDEs | | [Copilot Agent Mode](https://embracethered.com/blog/) | pre-Aug 2025 ([CVE-2025-53773](https://embracethered.com/blog/)) | independently-confirmed | settings.json write before approval gate; bootstrap ordering RCE; patched Aug 2025 | | [Copilot Chat — CamoLeak](https://www.legitsecurity.com/blog/camoleak) | pre-Aug 2025 | independently-confirmed | HTML-comment injection → Camo proxy exfil; CVSS 9.6; bypassed GitHub CSP; patched Aug 2025 | | [Copilot Chat — RoguePilot](https://orca.security/resources/blog/roguepilot/) | pre-Feb 2026 | independently-confirmed | Issue-embedded injection → symlink bypass → GITHUB_TOKEN exfil; remediated Feb 2026 | | [copilot-instructions.md — Rules File Backdoor](https://github.com/0x6f677548/copilot-instructions-unicode-injection) | All versions (unpatched) | independently-confirmed | Unicode Tag chars (U+E0000) invisible to reviewers; GitHub banner only; both vendors declined to patch | | [Copilot Chat — Filename Injection](https://www.tenable.com/security/research/tra-2025-53) | VS Code 1.101.2 (TRA-2025-53, unpatched) | independently-confirmed | Filename processed as instruction; Microsoft declined to patch; permanent attack surface | | [GitHub Copilot agent firewall](https://docs.github.com/en/copilot/using-github-copilot/using-the-github-copilot-coding-agent/about-the-github-copilot-coding-agent) | All versions | source-reviewed | MCP servers and copilot-setup-steps bypass firewall entirely; documented design | | GitHub Copilot — Trail of Bits picture-tag | August 2025 | source-reviewed | `` tags bypass GitHub's Unicode/HTML comment filter; partial mitigation only | **Confidence:** empirical — 11 environments reviewed across source disclosures from March 2025–March 2026. Independently confirmed by [CVE-2025-64660 / GHSA-j8xq-6qq7-vfv7](https://github.com/advisories/GHSA-j8xq-6qq7-vfv7), [CVE-2026-29783](https://nvd.nist.gov/vuln/detail/CVE-2026-29783), [CVE-2026-21516](https://nvd.nist.gov/vuln/detail/CVE-2026-21516), [CVE-2025-53773](https://embracethered.com/blog/), [CamoLeak (Legit Security)](https://www.legitsecurity.com/blog/camoleak), [RoguePilot (Orca Security)](https://orca.security/resources/blog/roguepilot/), [TRA-2025-53 (Tenable)](https://www.tenable.com/security/research/tra-2025-53), and [Elastic Security Labs MCP whitepaper (January 2026)](https://www.elastic.co/security-labs). **Strongest case against:** Most high-severity CVEs in this finding are patched. An organization that has updated all clients (VS Code >= 1.106.2, CLI >= 0.0.423, JetBrains post-Feb 2026), added CODEOWNERS protection on all instruction paths, and does not source instruction files from public templates has closed the majority of the listed chains. The two vendor-declined vectors (Rules File Backdoor, filename injection) require attacker access to the workspace or repo — if repository write access is tightly controlled, the practical attack surface shrinks significantly. GitHub continues to improve the security model iteratively, and the patch cadence across 2025–2026 shows active investment. **Open questions:** Does CODEOWNERS protection on `copilot-instructions.md` effectively block all instruction injection paths, or can `.github/instructions/*.instructions.md` serve as a fallback injection surface without CODEOWNERS protection? Has the bootstrap ordering architectural issue (agent writes workspace config before permission gates activate) been resolved at the model level, or only at the individual CVE level? What is the scope of MCP tool name collision exposure in practice — does GitHub have any roadmap for tool provenance verification? Seen different? [Contribute your evidence](https://theorydelta.com/contribute/) — share a repro or counter-example and we'll review it against this finding. Reader evidence is what keeps these findings accurate.