Coding assistants

Adversa AI researchers described Cryptographic Context Injection (CCI), a technique that hides malicious instructions inside encrypted content so GitHub Copilot CLI treats them as trusted context. In a demonstration, Copilot read a ".env.prod" file and sent its contents to an attacker-controlled endpoint in 28 seconds without confirmation. The attack requires autopilot mode and a model willing to execute the decrypted instructions, and GitHub declined to treat it as a vulnerability.

GitHub Copilot CLI can be made to read a developer's local files and send them to an attacker from a single web page. The attack, Cryptographic Context Injection (CCI), hides instructions as ciphertext that the agent decrypts in its own shell and trusts as its own, and the researchers say one attacker-controlled URL fetched in autopilot mode was enough to exfiltrate a .env.prod file in 28 seconds.

A researcher presented at BlueHat Asia 2026 in Singapore on Microsoft's Copilot in SQL Server Management Studio (SSMS). The talk covered CVE-2026-65669, a SQL Server Elevation of Privilege Vulnerability that Microsoft rated critical.

Z.ai disabled several features of its ZCode coding assistant after a default setting was found sending users' local code repositories to Alibaba Cloud servers in China without consent. An independent blogger, Ferstar, reported that the client packaged full workspaces, including .git history and global app configs, and uploaded them to Aliyun OSS. The company removed the feature from its latest release and said it had deleted the associated cloud storage.

CVE-2026-55946 is an improper neutralization of special elements used in a command ('command injection') flaw in Microsoft Copilot. An unauthorized attacker can exploit it over a network to disclose information.

CVE-2026-81381 describes insufficiently protected credentials in GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit this over a network to disclose information.

CVE-2026-81380 is a command injection flaw (CWE-77 style wording: improper neutralization of special elements used in a command) affecting GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit it over a network to disclose information.

CVE-2026-58616 is a race condition (CWE-362, improper synchronization of a shared resource) in Copilot Chat in Microsoft Edge. An authorized attacker can exploit it over a network to disclose information.