Coding assistants

Johann Rehberger describes a design flaw in agentic systems that lets one coding agent rewrite another agent's configuration, freeing it from its sandbox. In his demo, a prompt-injected GitHub Copilot writes a malicious MCP server into Claude Code's config, which then runs arbitrary code. The post notes that Claude can reciprocate by modifying Copilot's configuration.

CVE-2025-58401 affects the Obsidian GitHub Copilot Plugin in versions prior to 1.1.7. The plugin stores the GitHub API token in cleartext form (CWE-312), so an attacker may perform unauthorized operations on the linked GitHub account. JPCERT/CC assigned a CVSS 4.0 score of 5.1 (MEDIUM), and NVD had not yet provided an assessment.

This post describes a prompt injection flaw in GitHub Copilot and VS Code, tracked as CVE-2025-53773, that leads to full system compromise of the developer's machine. The attack places Copilot into YOLO mode by modifying the project's settings.json file. The author notes that agents able to write files and alter their own configuration or security-relevant settings can reach remote code execution, a pattern similar to one recently described for Amp.

CVE-2025-53774 is an information disclosure vulnerability in Microsoft 365 Copilot BizChat, an exclusively hosted service. It is classified as CWE-77, Improper Neutralization of Special Elements used in a Command ('Command Injection'). NVD published it on 08/07/2025 and last modified it on 08/14/2025, and NIST has not yet provided an NVD assessment.

The author compares system prompt changes in Microsoft 365 Copilot (BizChat) over time and notes that a single enterprise_search tool used to exist. The tool was previously used in the Copirate ASCII Smuggling exploit to search a user's inbox for MFA codes.

CVE-2024-9333 is a permissions bypass in the M-Files Connector for Copilot before version 24.9.3. Incorrect access control list calculation lets an authenticated user access a limited number of documents. The CNA, M-Files Corporation, scores it CVSS 4.0 5.3 (MEDIUM), and NVD has not yet provided an assessment.

Johann Rehberger describes an exploit chain against Microsoft 365 Copilot that let an attacker steal a user's emails and personal information. The chain combines prompt injection delivered through a malicious email or shared document, automatic tool invocation to pull in other emails and documents, and ASCII Smuggling to hide data inside clickable hyperlinks to an attacker-controlled domain. Rehberger first reported parts of the exploit to Microsoft in January 2024 and the full chain in February 2024, and disclosed it after MSRC approval.

A prompt injection flaw in the GitHub Copilot Chat VS Code extension allowed data exfiltration when the extension analyzed untrusted source code. The extension sends source code and user questions to a large language model, and the post describes how that input path could be abused. The source text does not give further technical detail in this excerpt.

A researcher found that Microsoft 365 Copilot can be attacked with conditional prompt injection payloads that behave differently depending on which user reads the content. The attacker embeds instructions in an email that check the recipient's name, so the payload activates only for specific targets. In a demo with three recipients, the researcher showed different outputs for each person.