Blog
Before your team lets an AI coding assistant run on its own
One web page was all it took. The Register reports that researchers at Adversa AI got GitHub Copilot CLI, a coding assistant that runs in a developer's terminal, to read a file full of passwords and send it to an outside server. The developer had only asked the assistant to read that specially prepared page while it was working on its own.
This isn't a reason to panic or to ban coding assistants. The setup was specific. But the lessons apply to any AI tool that can read files, run code and reach the internet, and that describes most coding assistants today.
(To avoid confusion: this is GitHub's developer tool, not the Copilot inside Microsoft 365.)
What happened
Copilot CLI has an "autopilot" mode. GitHub's documentation compares it to handing a task to a colleague: the assistant works through every step without stopping to check with you. GitHub says autopilot works best when you grant it all permissions, which lets it change files, run commands and fetch web pages as it sees fit.
In the researchers' test, a developer in autopilot asked the assistant to review a web page. The page held hidden instructions, scrambled with encryption so that safety filters couldn't read them, plus a request to unscramble them. While following along, the assistant read a .env file (a settings file that often holds passwords and access keys) and sent its contents to the attacker. Adversa says the whole chain took 28 seconds, and the assistant's own summary didn't mention it.
This is a form of prompt injection: instructions hidden in something the AI reads, rather than typed by the person using it. "Static guardrails read text; they do not run it," Adversa's Rony Utevsky explained.
Two details worth knowing
It depended on the model. One of the models offered inside Copilot followed the hidden instructions in about half of the researchers' attempts. Two others refused. On the "Auto" setting, the researchers say, users can't see which model handled their session.
GitHub and the researchers disagree. GitHub told The Register this isn't a product vulnerability, because the user chose to fetch untrusted content and allowed the tool to act. Adversa disagrees. You don't need to settle that argument to act on it.
Five checks for any team using AI coding assistants
1. No unknown links in hands-off mode. GitHub suggests autopilot for well-defined jobs like writing tests. Reading a stranger's web page isn't one of them. Make it a team habit to switch back to step-by-step approval before pointing the assistant at an outside link.
2. Keep secrets out of reach. Passwords and access keys shouldn't sit in plain files the assistant can read, and that includes files elsewhere on the same machine, not just the project folder. The researchers say the attack reached files outside the project too. Use test keys with limited access during development, so a leaked key is easy to replace and doesn't unlock much.
3. Use a sandbox. GitHub's own docs suggest one before granting wide permissions. A sandbox is a fenced-off workspace: the assistant can do its job inside it, but steps that reach outside, like writing files beyond the project folder, are blocked.
4. Switch off what the job doesn't need. Copilot CLI lets you deny specific tools, such as web fetching, for a session. GitHub's docs say deny rules win even when "allow all" is turned on.
5. Know which model you're getting. If your tool picks a model automatically, find out whether you can choose one yourself, and test it on the work your team actually does.
The bigger habit
An AI assistant treats what it reads as part of its instructions. Anything from outside your business, like web pages, emails or documents from strangers, deserves the same care as an attachment from an unknown sender: possibly useful, never trusted by default.
Coding assistants are now part of how teams build their own tools, so the guardrails need to cover how a tool gets built, not just the finished tool.
Sources
- "Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets", The Register, 2026-10-06. theregister.com
- "GitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secrets", Adversa AI, 2026-10-06. https://adversa.ai/blog/cryptographic-context-injection-github-copilot/
- "Allowing GitHub Copilot CLI to work autonomously", GitHub Docs, accessed 2026-10-07. https://docs.github.com/en/copilot/concepts/agents/copilot-cli/autopilot
- "Allowing and denying tool use", GitHub Docs, accessed 2026-10-07. https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/allowing-tools
