RoguePilot: How Hidden Instructions in GitHub Issues Let Attackers Hijack Repositories

A New Class of Developer Tool Exploitation

The promise of AI coding assistants has always carried an implicit trust assumption: that the code suggestions, explanations, and actions these tools produce are aligned with the developer’s intent. GitHub Copilot, the most widely adopted AI coding assistant with over 20 million cumulative users as of mid-2025 and more than 1.3 million paid subscribers, has become deeply embedded in professional development workflows across over 50,000 organizations, including 90% of Fortune 100 companies.

That trust assumption was shattered in February 2026 when Orca Security’s Research Pod published its findings on “RoguePilot,” a vulnerability class that demonstrated how hidden malicious instructions planted in GitHub Issues could commandeer Copilot’s agent capabilities within GitHub Codespaces, exfiltrate privileged GITHUB_TOKEN credentials, and achieve full repository takeover — all without the developer taking any explicitly risky action.

The discovery represents a watershed moment for the intersection of AI-assisted development and software supply chain security. It proves that the passive consumption of untrusted content — simply launching a Codespace from a GitHub Issue — can be weaponized into an active attack vector with severe consequences.

The Attack Chain: From Hidden Comment to Repository Takeover

The RoguePilot attack exploits a fundamental characteristic of how GitHub Copilot processes context within Codespaces. When a developer launches a Codespace from a GitHub Issue, Copilot automatically ingests the issue’s description as a prompt to generate an initial response. This trusted developer workflow becomes the entry point for exploitation.

Stage 1: Planting the Payload

The attack begins with an adversary creating or editing a GitHub Issue in a target repository. The malicious instructions are embedded within HTML comment tags (``) — syntax that is invisible when viewing the issue through GitHub’s web interface but fully present in the raw Markdown source that Copilot processes.

This is the core of the passive prompt injection technique: the payload is invisible to the human developer but fully visible to the AI assistant. The attacker does not need any special permissions — creating issues on public repositories is open to anyone, and the embedded instructions survive GitHub’s rendering pipeline because HTML comments are valid Markdown.

Stage 2: Activating Copilot via Codespace Launch

When a developer launches a Codespace from the poisoned issue, Copilot is automatically fed the issue’s description as input. The hidden instructions become part of Copilot’s operational context. Because current LLMs cannot reliably distinguish between trusted system prompts and injected instructions within their context window, the malicious directives are treated as actionable commands.

Stage 3: Symlink Exploitation and Token Exfiltration

The attack chains three distinct techniques to achieve credential theft. First, the injected instructions direct Copilot to check out a crafted pull request that contains a symbolic link — a file named `1.json` that actually points to `/workspaces/.codespaces/shared/user-secrets-envs.json`, an internal file containing the privileged GITHUB_TOKEN.

Critically, while Copilot has guardrails that prevent it from following links directly, it does not validate symbolic links within the repository structure. When Copilot reads the symlinked file, it unknowingly accesses the secrets file containing the token.

The exfiltration mechanism exploits a default VS Code configuration: `json.schemaDownload.enable` is enabled by default in Codespaces. The injected instructions direct Copilot to create a JSON file with a `$schema` URL property that embeds the leaked GITHUB_TOKEN as query parameters pointing to an attacker-controlled server. When VS Code automatically fetches the schema URL, the token is transmitted to the attacker.

Stage 4: Repository Takeover

With the exfiltrated GITHUB_TOKEN — which is typically scoped to the repository in use with both read and write access — the attacker gains programmatic control over the repository. This can include pushing malicious code, modifying CI/CD pipeline configurations, accessing stored secrets, and altering release artifacts. Orca Security’s demonstration achieved full repository takeover through this chain.

Why This Attack Is Different

Prompt injection attacks against LLMs are not new — researchers have demonstrated them since the early days of large model deployments. But RoguePilot is qualitatively different from prior demonstrations in several critical ways.

First, the attack is entirely passive from the victim’s perspective. The developer does not need to copy-paste suspicious code, click a malicious link, or take any action beyond normal workflow behavior. Simply launching a Codespace from a malicious issue is sufficient to trigger the attack chain. The attack required no special privileges, no code execution by the victim, and no social engineering beyond creating a malicious GitHub Issue — placing it firmly within the reach of low-sophistication threat actors.

Second, the attack exploits a tool that developers implicitly trust and that operates with their credentials. Copilot runs within the developer’s Codespace environment with access to environment variables that include authentication tokens. This is not a privilege escalation in the traditional sense — it is a trust exploitation where the AI assistant becomes an unwitting insider threat.

Third, the attack chains multiple seemingly benign features — HTML comment parsing, symbolic link resolution, and automatic JSON schema downloading — into a coherent exploitation path. No single feature is a vulnerability on its own, but their combination creates a lethal attack chain.

GitHub’s Response and the Patch

Following Orca Security researcher Roi Nisimi’s responsible disclosure, GitHub responded promptly and worked with the Orca Research Pod throughout the remediation process. The vulnerability has been patched.

The mitigations addressed the specific mechanisms that RoguePilot exploited: the symbolic link traversal that allowed access to internal secrets files, the unchecked ingestion of hidden HTML comment content as Copilot prompts, and the default schema download behavior that enabled exfiltration.

However, security researchers have noted that these mitigations address the specific RoguePilot attack vector without solving the underlying problem: that LLMs fundamentally cannot distinguish between instructions and data within their context window. The content sanitization approach relies on pattern matching to identify injection attempts, which creates an adversarial cat-and-mouse dynamic where attackers can modify their payloads to evade detection.

This limitation is not unique to GitHub Copilot. In August 2025, a separate critical vulnerability (CVE-2025-53773) demonstrated that GitHub Copilot’s ability to modify project configuration files could be exploited for remote code execution through prompt injection, potentially creating what researchers termed “ZombAIs” — AI-controlled compromised developer machines joined to botnets. Additionally, researchers at Legit Security discovered the “CamoLeak” vulnerability (CVSS 9.6) in Copilot Chat, which allowed data exfiltration from private repositories through prompt injection.

The Systemic Risk: Prompt Injection Across the Developer Toolchain

RoguePilot is not an isolated vulnerability — it is a symptom of a systemic risk that affects the entire AI-assisted developer toolchain. As AI coding assistants become more capable and more deeply integrated into development workflows, the attack surface grows proportionally.

Consider the trajectory of AI coding tools. Early versions offered simple code completion — a relatively low-risk capability because the output was always reviewed by the developer before use. Current-generation tools like Copilot Workspace, Cursor, and Windsurf operate as agents that can read files, execute terminal commands, modify code across multiple files, and interact with external services. Each of these capabilities represents a potential exploitation vector if the agent’s reasoning can be manipulated.

The problem extends beyond GitHub Copilot. Trail of Bits published research in August 2025 demonstrating prompt injection attacks that could trick Copilot into inserting malicious backdoors into open-source software through carefully crafted issue descriptions. In October 2025, they further demonstrated prompt injection to remote code execution across multiple AI agent platforms, revealing design antipatterns that enabled argument injection attacks to bypass human approval protections.

The developer toolchain is particularly attractive to attackers because it sits at the intersection of high-value targets — source code, credentials, infrastructure configurations — and high-trust environments where developers expect their tools to work on their behalf. Malicious npm packages have been discovered hiding prompt injection payloads in README files and documentation, targeting AI-assisted tools that read package metadata. A compromised development environment can cascade into compromised production deployments, making this a critical supply chain risk.

Defending the AI-Assisted Development Workflow

The RoguePilot disclosure has catalyzed a broader conversation about securing AI-assisted development. Several defensive strategies have emerged, though the field remains nascent.

Token Scoping and Rotation

The most immediately actionable defense is minimizing the permissions and lifetime of tokens accessible in development environments. GITHUB_TOKEN should be scoped to the minimum permissions required for the current task, and organizations should implement automatic rotation and expiration policies. Fine-grained personal access tokens, introduced by GitHub in public beta in October 2022 and graduated to general availability in March 2025, should replace classic tokens wherever possible.

Context Isolation

Development environments should enforce strict boundaries between trusted and untrusted content. AI assistants should process external content — issues, documentation, third-party code — in sandboxed contexts that do not have access to credentials or sensitive resources. Symbolic links within repositories should be validated to prevent traversal to internal system files. This is architecturally challenging but essential for long-term security.

Content Scanning for Hidden Instructions

Organizations should implement scanning tools that analyze the raw content of issues, PRs, and documentation for hidden injection payloads — including HTML comments, zero-width characters, Unicode obfuscation techniques, and other invisible content methods. Several tools have emerged post-RoguePilot specifically for this purpose, including open-source scanners that can be integrated into CI/CD pipelines.

Human Review for High-Impact Actions

AI coding assistants should require explicit human confirmation before executing actions with significant security implications — including accessing credentials, modifying CI/CD configurations, pushing code to protected branches, and interacting with external services. The convenience cost of these confirmation steps is minimal compared to the risk they mitigate.

Organizational Policy and Awareness

Security teams need to update their threat models to account for AI-assisted development tools. Snyk’s AI code security research found that over 56% of developers reported that AI-generated code sometimes or frequently introduced security issues, yet only 10% scan most of the AI-generated code. Organizations should audit which tools are in use, what permissions they have, what content they process, and what actions they can take. Developer security training should be updated to cover the risks of prompt injection in AI tools — a category that most current training programs do not address.

The Broader Implications

RoguePilot marks a turning point in how the security community thinks about AI-assisted development. The convenience and productivity gains of AI coding assistants are real and significant — but they come with a fundamentally new risk profile that the industry’s security practices have not yet adapted to address.

The vulnerability also raises questions about liability and responsibility. When an AI assistant, acting on hidden malicious instructions, exfiltrates credentials that lead to a breach, who bears responsibility? The developer who used the tool? The tool vendor who did not prevent the injection? The platform that hosted the malicious content? These questions will become increasingly urgent as AI-assisted development becomes the default rather than the exception.

For now, the practical takeaway is clear: AI coding assistants should be treated as powerful but potentially manipulable tools that require the same security governance applied to any other component of the development infrastructure. The era of treating them as benign productivity enhancers is over.

Frequently Asked Questions

Sources & Further Reading

• RoguePilot: Exploiting GitHub Copilot for a Repository Takeover — Orca Security
• RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN — The Hacker News
• GitHub Issues Abused in Copilot Attack Leading to Repository Takeover — SecurityWeek
• Prompt Injection Engineering for Attackers: Exploiting GitHub Copilot — Trail of Bits
• GitHub Token Security Best Practices: Automatic Token Authentication — GitHub Docs
• Introducing Fine-Grained Personal Access Tokens for GitHub — GitHub Blog