GitHub Copilot Exploited to Perform Full Repository Takeover via Passive Prompt Injection
A significant vulnerability, known as RoguePilot, was identified in GitHub Codespaces. This flaw allowed attackers to take over repositories by embedding malicious instructions in GitHub Issues.
A significant vulnerability, known as RoguePilot, was identified in GitHub Codespaces. This flaw allowed attackers to take over repositories by embedding malicious instructions in GitHub Issues.
The vulnerability was discovered by the Orca Research Pod and exploited the integration between GitHub Issues and the Copilot AI agent in Codespaces. This allowed for a repository takeover without direct attacker interaction.
The vulnerability was disclosed to GitHub, leading to a patch by Microsoft following collaboration with the Orca team.
RoguePilot is identified as a Passive Prompt Injection attack where malicious instructions are hidden within data or environments processed by a language model. Unlike traditional attacks, this method is activated when a developer opens a Codespace from a compromised GitHub Issue, where Copilot automatically reads the issue's description as an initial prompt.
A significant vulnerability, known as RoguePilot, was identified in GitHub Codespaces.
The exploit chain involves embedding hidden instructions in a GitHub Issue using HTML comment tags, which are invisible to humans but readable by Copilot. Once a Codespace is opened, Copilot executes the instructions without alerting the developer.
The attack advances through a series of steps: executing a command to pull a crafted pull request, reading a secrets file via symbolic links, and creating a JSON file pointing to an attacker-controlled server. Copilot then appends a stolen GITHUB_TOKEN to this request, allowing the attacker to take over the repository.
Orca Security describes this vulnerability as a new type of AI-mediated supply chain attack, exploiting the AI's capabilities against the developer.
The attack highlighted the risk of assuming all text processed by AI agents is trustworthy, as it required no special privileges or interaction from the victim beyond creating a malicious GitHub Issue.
Orca's disclosure recommends several security measures: treating repository content as untrusted input, disabling passive AI prompts from external sources, setting json.schemaDownload.enable to false by default, enforcing robust symlink sandboxing, and using minimal-scope, short-lived tokens for Codespaces environments.
Based on reporting by Cyber Security News.