What happened
BeyondTrust Phantom Labs (Tyler Jespersen) published research showing that a single nearly-invisible comment on a GitHub issue can hijack the GitHub Copilot coding agent. The attacker's payload is an invisible prompt-injection string embedded in the issue comment that Copilot reads when it is assigned the issue. The demonstrated chain steals the agent's token, exfiltrates the agent token plus repository and organizational agent secrets, poisons every Copilot-prefixed branch, and — where the copilot-setup-steps.yml grants broad permissions — escalates into CI/CD and connected cloud accounts. The report includes an end-to-end proof of concept and was disclosed to GitHub; the issues were still unpatched at publication (Oct 21, 2026).
Why it matters
Copilot is one of the most widely deployed AI coding agents and operates with real repository permissions inside the development lifecycle. A comment that looks harmless to a human reviewer gives a remote attacker control of the agent, which holds secrets and CI/CD access — a low-friction, low-observer prompt-injection path to code and cloud compromise in AI-driven dev pipelines.
Attack vector
An attacker posts a crafted/invisible comment on a GitHub issue the Copilot agent is assigned to; the agent ingests the malicious instruction, runs malicious tool calls, and exfiltrates its token and org secrets.
Affected systems
GitHub Copilot coding agent (issue-assignment workflow), copilot-setup-steps.yml-configured repos
Mitigation
Audit agent-issue permissions and copilot-setup-steps.yml scopes; place a hard control boundary on the agent's token and secrets (least-privilege, short-lived credentials, no broad CI/CD perms); treat issue/comment text as untrusted input to the agent.