Disclosed vulnerability
GitHub Copilot Chat: prompt injection in source comments to chat-history exfiltration
AIR-2024-0020 AIR record · 2024-06-github-copilot-chat-exfil
From the supporting source
This means that using carefully crafted instructions in a source code file, an attacker can cause the LLM to return hyperlinks to images which will then be automatically retrieved.embracethered.com
The record
Disclosed
2024-06-14
Vendor
Microsoft / GitHub
Product
GitHub Copilot Chat VS Code extension
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot Chat rendered an image exfiltrating chat history
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection source code
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Copilot Chat users opening untrusted repositories
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed 2024-06-12 by disabling markdown image rendering in Copilot Chat; validity confirmed 2024-03-06
Taxonomy & references
Curator notes
Johann Rehberger.
Supporting sources
Cite as
Enkrypt AI. "GitHub Copilot Chat: prompt injection in source comments to chat-history exfiltration". AIR, AIR-2024-0020. https://agentincident.vercel.app/i/AIR-2024-0020/ (accessed 2026-10-19).