Coding assistants

Adversa AI researchers described Cryptographic Context Injection (CCI), a technique that hides malicious instructions inside encrypted content so GitHub Copilot CLI treats them as trusted context. In a demonstration, Copilot read a ".env.prod" file and sent its contents to an attacker-controlled endpoint in 28 seconds without confirmation. The attack requires autopilot mode and a model willing to execute the decrypted instructions, and GitHub declined to treat it as a vulnerability.

GitHub Copilot CLI can be made to read a developer's local files and send them to an attacker from a single web page. The attack, Cryptographic Context Injection (CCI), hides instructions as ciphertext that the agent decrypts in its own shell and trusts as its own, and the researchers say one attacker-controlled URL fetched in autopilot mode was enough to exfiltrate a .env.prod file in 28 seconds.

A researcher presented at BlueHat Asia 2026 in Singapore on Microsoft's Copilot in SQL Server Management Studio (SSMS). The talk covered CVE-2026-65669, a SQL Server Elevation of Privilege Vulnerability that Microsoft rated critical.

Z.ai disabled several features of its ZCode coding assistant after a default setting was found sending users' local code repositories to Alibaba Cloud servers in China without consent. An independent blogger, Ferstar, reported that the client packaged full workspaces, including .git history and global app configs, and uploaded them to Aliyun OSS. The company removed the feature from its latest release and said it had deleted the associated cloud storage.

Varonis disclosed CoSnitch, a critical flaw in the personal version of Microsoft Copilot, which chains a ?q= URL parameter and an undocumented parameter to run attacker prompts on page load with no click. The attack can exfiltrate data from connected apps such as Gmail, Drive, Calendar or OneDrive to an attacker-controlled webhook, and can poison persistent memory via web summarization. Microsoft issued a patch on Tuesday, almost eight months after Varonis reported the flaw on December 31; a partial fix had come on February 1.

Researchers described a "meta-hacking" technique that manipulates an AI service into revealing its own security weaknesses. The title indicates the attack, named CoSnitch, tricked Copilot into mapping out its architecture.

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch, that could let a single click on a crafted link silently pull data from connected apps and the victim's Copilot session. The one-click path depends on the undocumented autorun=1 URL parameter combined with the existing q parameter, which together run an attacker-supplied prompt on page load in the victim's authenticated session. Tracked as CVE-2026-24301, the flaws affect the consumer assistant at copilot.microsoft.com, and the researchers found no evidence of in-the-wild exploitation.

Wiz Research's Red Agent, an autonomous AI-powered security research tool, found a script injection vulnerability in snowflakedb/snowflake-connector-net through Snowflake's HackerOne program. The jira_issue.yml GitHub Actions workflow, triggered by issues opened, interpolated the attacker-controlled issue title into a shell script, letting any GitHub user run arbitrary commands on a runner by opening a crafted issue. The flaw was introduced on June 18, 2026 by PR #1218, co-authored by Copilot Autofix, and Wiz disclosed it on June 23, 2026.

Norwegian AI researcher Håkon Måløy published details of an AI worm that spreads through Microsoft Word and Copilot. An attacker can hide instructions in a document used as source material for Copilot-generated or Copilot-edited Word documents, where they can alter figures and copy themselves into new documents that carry the attack into other Copilot-assisted workflows. Microsoft confirmed the findings and said it has addressed them.

Norwegian AI researcher Håkon Måløy reported that an attacker can hide instructions in a Word document that Copilot later uses as source material, so the malicious instructions can alter figures in the newly generated document and copy themselves into it. Microsoft confirmed the report and said it addressed the findings, but Måløy said the core vulnerability had not yet been fixed when he published.

Håkon Måløy disclosed a technique in which hidden instructions in a Word document make Microsoft 365 Copilot halve financial figures in a report and copy the same instructions, in white eight-point text, into the finished file. The chain spreads only through further Copilot drafting or editing operations, and the disclosure reports no exploitation in the wild and no public CVE. Måløy says the attack class still reproduced on July 28, after Microsoft deployed two mitigations.