1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. The dominant risk concentrates in tool execution and configuration surfaces where documented single-step approval bypasses combine with demonstrated prompt-injection-to-RCE chains across multiple independent research efforts.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Agent-specific NVD CVEs with critical and high severity anchor both the attack surface and the blast radius scores while vendor-documented controls keep the defense floor at the minimum tier.
The attack surface sits in the upper band while blast radius falls just below the quadrant boundary, producing a profile where exploitation pathways are well-demonstrated but damage scope is partially bounded by session isolation and PR-only deployment constraints.
Each metric measures a distinct axis: attack surface and blast radius scale to ten, defense controls sum to fifteen, and the composite weights defense as a multiplier on capability per unit of risk.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 5.32 | Demonstrated exploitation chains and critical CVEs anchor the composite below the median for coding agents with meaningful defense controls. |
| Blast Radius | 6.38 / 10 | Full shell and file system access at user privilege with unrestricted outbound network on the local agent drives the capability envelope. |
| Attack Surface | 6.96 / 10 | Multiple agent-specific CVEs with high and critical severity confirm exploitation across tool execution, output processing, and configuration surfaces. |
| Defense Controls | 5 / 15 | Vendor documents controls for all five components but each depends on opt-in configuration or carries a documented single-step bypass path. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposures are the unrestricted tool execution surface with demonstrated approval-bypass chains, the auto-loaded configuration files, and the output rendering channel exploited for credential theft.
Three surfaces reach the adjusted ceiling and two more sit at the high band, reflecting confirmed exploitation rather than architectural exposure alone.
Each row pairs the architectural exposure level with agent-specific evidence anchors that justify non-zero penalties where exploitation has been demonstrated.
| Surface | Score | Comments |
|---|---|---|
| User Input | 4 / 4 | Multiple unvalidated input channels including IDE chat, CLI, web interface, and MCP responses with no prompt shield; independent testing confirmed high injection success rates across multiple backing LLMs. [2][10][11][13] |
| External Data | 4 / 4 | Ingests content from cloned repositories including nested bare git repos that exploit core.fsmonitor for arbitrary code execution during routine git operations in the CLI deployment mode. [5][6] |
| Memory | 1 / 4 | Session-level context only with no cross-session persistent memory store; workspace instruction files persist but require explicit operator placement. [15] |
| Reasoning | 2 / 4 | Multi-step reasoning with visible tool call chain and user-selectable model; current configuration limits but does not eliminate reasoning-surface exposure since tool outputs feed back into the next reasoning step. [15] |
| Planning | 3 / 4 | Autonomous task decomposition in cloud coding agent with configurable approval; CLI sessions delegate to background worktrees with limited tool scope. [18] |
| Tool Execution | 5 / 4 | Full shell with user privileges and approval gates bypassable via slash command; bash expansion patterns bypassed the CLI safety assessment enabling hidden execution across multiple platform variants. [2][3][4][7][8] |
| Orchestration | 2 / 4 | Multi-step execution within supervised sessions; CLI background agents run in isolated worktrees with restricted tool access and no scheduling capability. [15] |
| Inter-Agent | 3 / 4 | Connects to external MCP servers with per-server trust prompt; the cloud agent firewall explicitly documents that MCP interactions bypass network restrictions. [16] |
| Output Processing | 5 / 4 | Critical-severity zero-click exfiltration demonstrated via PR description injection routing stolen credentials through the platform's own image proxy infrastructure. [1][19] |
| Configuration | 5 / 4 | Auto-loads workspace settings and project instruction files; demonstrated attack chain modifies settings to enable unrestricted execution mode and self-replicating worm propagation from untrusted file content. [2][6][8][12] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. On the documented default configuration without operator opt-in, GitHub Copilot processes repository files and MCP responses authored by third parties, accesses private source code and credentials in the workspace, and sends bytes outbound through terminal commands, fetch requests, and MCP server calls.
GitHub Copilot exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Repository files, GitHub issues, PR descriptions, and MCP server responses carry adversary-authored content into the reasoning loop. [9][10]
- Sensitive data — The agent reads private repository source code, API keys, and workspace credentials with the authenticated user's full access scope. [1][15]
- External egress — Terminal commands, the fetch tool, MCP server calls, and rendered output URLs provide default outbound channels that bypass the cloud firewall. [16][19]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. Compromise of the local agent reaches the operator's full shell environment, workspace file system, environment variables, and unrestricted outbound network while the cloud agent is bounded to PR creation.
Four of six factors sit at the high band reflecting user-privilege shell access and workspace-scoped data reach on the local deployment mode.
Each row ties the blast factor score to the specific workflow node or access scope the agent holds by default on its documented configuration.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 3 / 4 | Full user-level shell execution with demonstrated privilege escalation from prompt injection to unrestricted command execution via approval bypass. [2][8] |
| File system access | 3 / 4 | Read-write access across the workspace via file tools in all modes; home directory access available in the default unsandboxed mode where terminal commands are unrestricted. [2][15] |
| Network access | 3 / 4 | Unrestricted outbound network on the local agent exposes source code, credentials, and session tokens to exfiltration; cloud agent firewall restricts Bash tool processes only while MCP and fetch bypass the boundary. [16] |
| Credential access | 3 / 4 | Access to workspace environment variables, API keys, and tokens; demonstrated theft of AWS keys and private secrets from accessible repositories. [1] |
| Autonomous action | 2 / 4 | The hosted coding agent works independently on assigned GitHub issues but cannot merge to protected branches without human reviewer approval. [18] |
| Deployment access | 1 / 4 | Cannot commit directly to default branches; PR creation may trigger CI workflows configured with pull_request event triggers but merging and deployment require human approval. [18] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Vendor documents controls for every component but each ships as opt-in or carries a single-step bypass, leaving the default posture at the minimum vendor-documented tier across all five.
Higher scores indicate stronger vendor-implemented safeguards; the uniform minimum reflects documented controls that require operator activation to reach their designed tier.
Each component is scored on what ships by default as a vendor-implemented control versus what requires operator configuration to activate.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Workspace Trust blocks agents in untrusted workspaces but no dedicated prompt shield or ML injection detection runs on trusted workspace input. [15] |
| Execution Isolation | 1 / 3 | OS-level sandbox exists for terminal commands but is disabled by default; cloud agent runs in a firewalled Actions appliance with documented MCP bypass per vendor threat model. [14][15][16] |
| Action Controls | 1 / 3 | Default Approvals mode requires confirmation for sensitive tools but one operator command or configuration change disables every approval gate instantly. [20][21] |
| Output Guardrails | 1 / 3 | Image rendering disabled after the critical exfiltration patch; cloud agent runs secret scanning on generated output; no DLP on local agent. [1][18] |
| Monitoring | 1 / 3 | Cloud agent session logs are reviewable in PRs; enterprise audit API covers cloud sessions as opt-in but local IDE sessions produce no structured audit events by default. [17][18] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize enabling the OS-level sandbox, restricting the permission level to Default Approvals via enterprise policy, and deploying agent sessions inside dev containers.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require all developer workstations to open untrusted repositories in restricted mode via enterprise Workspace Trust policy — counters User Input at adjusted ceiling.
- Configuration Enable the MCP registry-only policy to restrict MCP servers to a curated organizational allowlist — counters untrusted MCP responses reaching the reasoning loop.
- Engineering Deploy a proxy-layer prompt injection classifier between MCP server responses and the agent context window — counters external data ingestion without validation.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Mandate dev container usage for all Copilot agent sessions via organizational development environment policy — counters Execution Isolation at minimum default tier.
- Configuration Set chat.tools.terminal.sandbox.enabled to on in organizational settings to enforce OS-level sandboxing for terminal commands — counters disabled sandbox default.
- Engineering Build a hardened dev container template with rootless operation, capability drop, and egress firewall allowlisting — counters unrestricted local shell access.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Disable Bypass Approvals and Autopilot permission levels via enterprise policy to prevent single-step approval bypass — counters Action Controls at minimum tier.
- Configuration Configure chat.tools.terminal.autoApprove deny-list to block destructive commands and network utilities even in elevated permission modes — counters approval bypass surface.
- Engineering Implement a CI-side validator that rejects PRs containing settings.json modifications to auto-approve configuration keys — counters the demonstrated YOLO-mode escalation chain.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Restrict which domains the fetch tool and Simple Browser can reach via chat.agent.networkFilter enterprise policy — counters outbound exfiltration channels.
- Configuration Enable network domain filtering with an allowlist limited to npm registry, GitHub API, and internal artifact store domains for all agent-initiated web requests — counters credential exfiltration via rendered URLs.
- Engineering Deploy a DLP proxy layer inspecting agent-initiated outbound requests for encoded credential patterns — counters the exfiltration technique class demonstrated by CamoLeak.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require enterprise audit API enrollment for all Copilot-using organizations to ensure structured prompt and response logging — counters absent default audit trail.
- Configuration Forward Copilot audit events to the organizational SIEM and configure alerting on auto-approve mode activation — counters silent tool execution without oversight.
- Engineering Build a real-time classifier over agent session logs that flags tool-call frequency spikes, encoded credential patterns in outbound requests, and settings.json modification sequences — counters absent anomaly detection.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2025-59145 CamoLeak zero-click exfiltration (CVSS 9.6) — prompt injection in PR descriptions coerced Copilot Chat to encode private repository secrets and exfiltrate them through the Camo image proxy bypassing CSP; patched by disabling image rendering
- CVE-2025-53773 Remote code execution via prompt injection (CVSS 7.8) — crafted content in repository files instructs Copilot to modify settings.json enabling auto-approve mode then executes arbitrary shell commands without user confirmation
- CVE-2026-21516 Command injection in Copilot for JetBrains (CVSS 7.8) — improper neutralization of special elements allows unauthorized code execution over a network; patched in version 1.5.63-243
- CVE-2026-29783 Shell expansion bypass in Copilot CLI — bash parameter expansion patterns bypass the read-only safety assessment to execute hidden commands even in approval-required modes; patched in v0.0.423
- CVE-2026-45033 Bare repository code execution in Copilot CLI — nested malicious bare git repositories exploit core.fsmonitor to run arbitrary commands during routine git operations; patched in v1.0.43
- GHSA-9ccr-r5hg-74gf GitHub Security Advisory for CVE-2026-45033 — documents the bare repository discovery vulnerability and the safe.bareRepository=explicit fix via GIT_CONFIG_COUNT environment variables
- GHSA-g8r9-g2v8-jv6f GitHub Security Advisory for CVE-2026-29783 — documents dangerous shell expansion patterns and the parse-time detection plus unconditional blocking fix that applies even in auto-approve mode
Selected Research
- GitHub Copilot Remote Code Execution via Prompt Injection Johann Rehberger demonstrates the full RCE chain from prompt injection in source files through settings.json modification to unrestricted shell command execution on the developer machine
- Prompt injection engineering for attackers: Exploiting GitHub Copilot Trail of Bits designs a reliable prompt injection exploit via GitHub issues that tricks Copilot Agent into inserting a malicious backdoor into the software through a seemingly innocent pull request
- AIShellJack: Demystifying Prompt Injection Attacks on Agentic AI Coding Editors Academic study implementing 314 attack payloads covering 70 MITRE ATT&CK techniques against GitHub Copilot and Cursor achieving attack success rates up to 84 percent for malicious command execution
- GitHub Copilot Chat Prompt Injection via Filename Tenable demonstrates filename-based prompt injection in Copilot Chat Agent Mode that can trigger data exfiltration paths; vendor declined to fix stating Workspace Trust is the intended mitigation
- AgentHopper: An AI Virus Proof-of-concept self-replicating AI worm that targets GitHub Copilot by writing to settings.json for auto-approve mode then scanning and injecting other repositories with the propagation payload
- Wormable Command Execution via Prompt Injection in VS Code and Copilot Persistent Security demonstrates wormable command execution where prompt injection in README or source files escalates to arbitrary system commands across multiple backing LLMs
Vendor Documentation
- How GitHub agentic security principles make AI agents secure GitHub documents the threat model for hosted agentic products including network firewalling least privilege interpretability and the documented MCP firewall bypass
- VS Code Trust and Safety Microsoft documents agent sandboxing permission levels including Default Approvals and Bypass Approvals workspace trust boundaries and MCP server trust model for VS Code Copilot
- Customizing or disabling the firewall for GitHub Copilot cloud agent GitHub documents the cloud coding agent firewall including the explicit statement that MCP interactions bypass the firewall and that sophisticated attacks may bypass restrictions
- GitHub Copilot Compliance: SOC 2 Type 1 and ISO 27001 GitHub announces SOC 2 Type 1 report and ISO 27001 certification scope covering Copilot Business and Enterprise demonstrating controls for service security
- Risks and mitigations for GitHub Copilot cloud agent GitHub documents built-in security protections for the cloud coding agent including CodeQL scanning advisory database checks secret scanning and restricted push behavior
Other Sources
- CamoLeak: How GitHub Copilot Became An Exfiltration Channel BlackFog provides detailed analysis of the CamoLeak attack mechanics including the pre-computed Camo URL dictionary character-by-character encoding and the CSP bypass through trusted infrastructure
- VS Code Copilot settings reference Complete settings reference documenting chat.tools.global.autoApprove sandbox.enabled permission level defaults and the explicit warning that global auto-approve disables critical security protections
- VS Code agent tools and permissions Documents the permission picker including the /yolo and /autoApprove slash commands tool eligibility for auto-approval and the warning dialog for elevated permission levels