CamoLeak - GitHub Copilot Chat

Summary

Legit Security published CamoLeak in October 2025. The researcher reported finding it in June 2025: content placed in a pull request could shape how GitHub Copilot Chat responded to a different user reviewing that pull request, and could be used to move data from private repositories the victim had access to toward an external party.

This record is a red-team finding reported through HackerOne. It is not evidence of malicious exploitation. The researcher reports a CVSS value of 9.6; that value is researcher-assigned, not a CVE or GitHub score.

Classification and evidence status

Affected system and trust path

Copilot Chat answers with the permissions of the signed-in user and can use repository content as context. A pull request description can be written by anyone able to open one, so it is variable third-party content. When a maintainer asks Copilot about that pull request, the attacker's content and the maintainer's private repository access meet in one session.

High-level attack chain

At a high level: attacker-controlled pull request content became model context; the victim asked Copilot Chat about it; the retrieved content influenced the answer; and in the researchers' controlled demonstration, an output-rendering path could carry data from the victim's Copilot context to an external destination.

This record does not describe the encoding, the request construction, how the content security policy was worked around, the hidden-comment syntax or any prompt wording.

Demonstrated impact vs observed exploitation

Demonstrated: influence over another user's Copilot responses and exfiltration of secrets and source code from private repositories in the researcher's controlled test.

Observed against real customers: none reported in the cited source. The response being steered is model influence; the security impact came from the victim's repository access plus a rendering channel that could reach an attacker.

Enabling control gaps

• Hidden pull request content entered the assistant's context, so reviewers could not see what was influencing the response.
• A response-rendering feature created an outbound request path that could reach an external destination.
• The assistant could read across the victim's private repositories, not only the repository relevant to the question.

Vendor and researcher response

According to the researcher, the issue was reported via HackerOne, and GitHub fixed it by disabling image rendering in Copilot Chat. The disclosure states that GitHub reported the vulnerability fixed as of August 14 (2025). This status is taken from the researcher disclosure; no separate GitHub advisory is cited here.

Evidence defenders should retain

• Which repository content, including pull request bodies and their raw source, the assistant used for each response.
• Image and resource requests triggered while chat responses were displayed.
• Pull requests from unfamiliar accounts whose raw content differs from what the rendered view shows.
• Cross-repository reads by the assistant that were not needed for the question asked.

Defensive lessons

• Data Provenance: keep authorship and visibility of pull request content attached, including content hidden from the rendered view.
• Output Validation: restrict which output structures, such as images or links, a response may contain, separately from how it is rendered.
• Least Privilege: limit the assistant's reading to what the task needs.
• Agent Authorization: a proposal to read other repositories is a new decision, not something the model's context can authorize.

Related Learn topics

• AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
• Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.