Vulnerability / research

RoguePilot demonstrated repository takeover through Copilot in Codespaces

Reported

What happened

Orca showed that a malicious issue, repository symlink, and automatic JSON schema retrieval could make Copilot expose a Codespaces repository token.

Parties and reporting

AI tools and systems: GitHub Copilot, GitHub Codespaces

Outcome

Orca reported coordinated remediation with GitHub after demonstrating repository takeover. The cited report does not identify exploited customer repositories.

Operating lesson

Constrain symlink access, automatic schema downloads, and repository token permissions in agent workspaces.

Evidence and limits

Research proof of concept, not a reported in-the-wild compromise. The primary page dates disclosure February 16; later coverage used later dates.

Sources