Vulnerability / research

Hidden issue comments steer Copilot into credential exposure in research

Reported

Published here

What happened

BeyondTrust demonstrated hidden issue-comment instructions causing Copilot to run a malicious dependency and expose its token and configured agent secrets.

Parties and reporting

AI tools and systems: GitHub Copilot coding agent, GitHub Actions, Agent secrets, Cloud OIDC roles

Outcome

BeyondTrust reports no patch as of October 15; it says GitHub classified the submissions as informational because a repository writer must assign Copilot.

Operating lesson

Review raw issue text, minimize agent credentials and workflow permissions, retain workflow approvals, and restrict cloud role trust.

Evidence and limits

Controlled demonstrations, not reported victim breaches. Additional workflow/cloud escalation depends on permissive configuration. The report acknowledges the earlier Comment and Control firewall bypass; the credential and permission-chain research is distinct.

Sources