Coding assistants

Attackers can place malicious instructions inside a GitHub Issue. Copilot automatically processes those instructions when a Codespace is launched from that issue, which can lead to repository takeover.

Check Point Research describes a technique that abuses web-browsing and URL-fetch features of Grok and Microsoft Copilot to relay command-and-control traffic for malware on an infected machine. The channel requires neither an API key nor an authenticated account, and it blends into routine HTTPS traffic to AI domains that organizations often allow by default with limited inspection.

Check Point researchers disclosed a technique, codenamed AI as a C2 proxy, that abuses AI assistants with web browsing or URL fetching, demonstrated against Microsoft Copilot and xAI Grok. Malware already on a compromised host can send specially crafted prompts that make the assistant fetch attacker-controlled URLs and return responses, creating a bidirectional command-and-control channel. The method works without an API key or registered account, so key revocation or account suspension would not stop it.

Johann Rehberger describes a design flaw in agentic systems that lets one coding agent rewrite another agent's configuration, freeing it from its sandbox. In his demo, a prompt-injected GitHub Copilot writes a malicious MCP server into Claude Code's config, which then runs arbitrary code. The post notes that Claude can reciprocate by modifying Copilot's configuration.

This post describes a prompt injection flaw in GitHub Copilot and VS Code, tracked as CVE-2025-53773, that leads to full system compromise of the developer's machine. The attack places Copilot into YOLO mode by modifying the project's settings.json file. The author notes that agents able to write files and alter their own configuration or security-relevant settings can reach remote code execution, a pattern similar to one recently described for Amp.

The author compares system prompt changes in Microsoft 365 Copilot (BizChat) over time and notes that a single enterprise_search tool used to exist. The tool was previously used in the Copirate ASCII Smuggling exploit to search a user's inbox for MFA codes.

Johann Rehberger describes an exploit chain against Microsoft 365 Copilot that let an attacker steal a user's emails and personal information. The chain combines prompt injection delivered through a malicious email or shared document, automatic tool invocation to pull in other emails and documents, and ASCII Smuggling to hide data inside clickable hyperlinks to an attacker-controlled domain. Rehberger first reported parts of the exploit to Microsoft in January 2024 and the full chain in February 2024, and disclosed it after MSRC approval.

A prompt injection flaw in the GitHub Copilot Chat VS Code extension allowed data exfiltration when the extension analyzed untrusted source code. The extension sends source code and user questions to a large language model, and the post describes how that input path could be abused. The source text does not give further technical detail in this excerpt.