Aug 12, 2025Single source
GitHub Copilot prompt injection enables remote code execution (CVE-2025-53773)
AI loose in the worldInjectionDERIVED
Approved by person, Oct 12, 2026. How entries are approved
Johann Rehberger found a prompt-injection attack leading to full system compromise of a developer's machine in GitHub Copilot and VS Code (CVE-2025-53773). The attack placed Copilot into 'YOLO mode' by modifying the project's settings.json — exploiting the fact that Copilot Agent Mode writes file edits directly to disk without user approval, so an agent that can modify its own security-relevant settings can escalate to remote code execution.
What this means for youAt home and work, coding assistants that edit files on their own can be tricked by hidden text in a project into running harmful commands on your computer. Keep tools updated and require approval for agent file edits. Governments and companies should treat agent permissions as a security issue.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2413. It has not been edited since it was approved; the hash above would not match if it had. How to verify