GitHub Copilot Chat vulnerable to data exfiltration via prompt injection in untrusted source code

Johann Rehberger demonstrated that the GitHub Copilot Chat VS Code extension was vulnerable to data exfiltration via prompt injection. Because Copilot Chat interprets and renders markdown — including images — returned by the LLM, a carefully crafted instruction planted in an untrusted source file could make the model return hyperlinks to attacker-controlled images, which were then auto-rendered and silently sent the developer's data (including file contents) to the attacker inside the image URL.

What this means for youAt work, developers using AI coding assistants should know that opening an untrusted project could let hidden instructions pull out code or secrets. Organizations should check whether their assistant renders external images or links from model output and restrict it where possible.