Copilot CLI: GitHub Declined the Exfiltration Report, Then Shipped the Sandbox

As of October 8, 2026.

GitHub's answer to a Copilot CLI exfiltration report and the feature it shipped a day after the report went public rest on one premise. What a coding agent can reach is the user's choice. So the useful question for any team is what it has chosen, and whether that choice holds when the model does not.

What happened

On October 6, Adversa AI published an attack it calls Cryptographic Context Injection against GitHub Copilot CLI. In its demo, a user with the CLI in autopilot mode pastes a link and asks the agent to read the page. Twenty-eight seconds later, by Adversa's account, the full contents of a .env.prod file sit in an attacker's log, and nothing on screen says a file left the machine.

The page presents itself as encrypted content, with instructions to decrypt it in Python and two candidate keys. One key is real. The other is a template the agent can only fill in by reading local files, so it reads them, and that read is the theft. Decryption with the fake key fails by design, the real key works, and the decrypted text tells the agent to fetch a follow-up URL "to grab more context" with the harvested contents attached.

The encryption is what gets it through. Adversa reports that the same instructions in plaintext were caught as prompt injection and refused. Encrypted, they surface as the output of code the agent itself wrote and ran, and the agent treats them as its own. Its closing summary said it had "confirmed an authorized-reader endpoint."

A model you did not pick

Adversa tested three models offered inside Copilot. Microsoft's mai-code-1.1-flash ran the full chain in 50% of runs; two GPT-5.6 models consistently refused. On the paid account Adversa tested, the vulnerable model had to be picked by hand. On an account with model selection left on Auto, the router assigned it in some sessions and a safe model in others, and in Adversa's words "the user has no visibility into, or control over, which one they get."

Adversa also says the controls that would bound the attack are opt-in and off by default in autopilot. That left the model's refusal as the only barrier, and the router decided which model that was.

GitHub's ruling

Adversa reported the issue to GitHub's bug bounty program on September 17. On October 1, GitHub validated the finding and declined to treat it as a vulnerability, because the user "explicitly asked Copilot CLI to fetch attacker-controlled content while giving copilot full permissions to act autonomously." GitHub ruled it ineligible for a bounty and told Adversa it may make the behavior stricter in the future. Adversa disagrees, and says the chain still reproduced as of October 1.

GitHub's position is defensible on its own terms. A user who points an autonomous agent at an arbitrary page with full permissions has made the decision that matters. The Auto router is what complicates it: the user granted autonomy to Copilot, not to whichever model Copilot picked that session.

The sandbox

On October 7, GitHub made local sandboxing generally available in Copilot CLI, the Copilot app and VS Code sessions using Agent Host. In GitHub's words: "Tools and commands initiated by Copilot run with restricted access to the filesystem, network, credentials, and other system capabilities, based on policies defined by the developer or their organization." It runs on Windows, macOS and Linux, covers MCP and language servers, supports enterprise-managed policies, costs nothing extra, and "applies to tool execution regardless of which model Copilot uses."

That last clause answers the model lottery. A sandbox that keeps agent-run commands away from .env.prod and off unapproved hosts holds whether the router picks the model that refuses or the one that complies. The changelog does not say the sandbox is on by default, so check before assuming it.

What to do now

1. Turn on local sandboxing wherever Copilot runs autonomously. Limit file access to the workspace, deny network access except for the hosts the task needs, and keep credentials out of reach. If you manage an enterprise, set the policy centrally rather than per developer.
2. Keep autopilot away from untrusted content. Read external pages, issues and tickets in a session without tools or secrets, and pass only what you need into the session that can act. Adversa's chain needs both autopilot and a permissive model.
3. Pin a model you have tested for autonomous work. Auto may hand an autopilot session to a model that runs the chain.
4. Move secrets out of files an agent can read. A .env.prod in a project directory is in reach of every agent session there. Adversa notes the chain also read files outside the working directory.
5. Log tool calls with their resolved arguments. The agent's own summary misdescribed what happened. The signal Adversa describes is a sequence: untrusted content, then code execution, then file reads, then a request to a host the task does not need.

Where the boundary sits

Prompt-injection filters read text, and this attack never presents the malicious text until the agent decrypts it. CamoLeak taught the same lesson in 2025, when Copilot Chat leaked private code through pre-signed image URLs. A defense that only judges the words an agent reads misses both, which is why AI security is more than prompt injection.

GitHub's ruling says the user owns the grant. GitHub's sandbox gives the user a way to grant less. Teams running agents in autopilot should take both at their word and set the boundary in the sandbox, where it holds no matter which model answers.

Where Rafter fits

rafter secrets . scans a directory for secrets locally, with no account, which shows what an agent working in that directory could read. It does not sandbox Copilot or detect this attack; it tells you what to move before an agent can reach it.