Disclosed vulnerability
CamoLeak: silent exfiltration of private source code and secrets from GitHub Copilot Chat
AIR-2025-0145 AIR record · 2025-10-github-copilot-chat-camoleak
From the supporting source
a critical vulnerability in GitHub Copilot Chat (CVSS 9.6) that allowed silent exfiltration of secrets and source code from private reposlegitsecurity.com
The record
Disclosed
2025-10-08
Vendor
GitHub/Microsoft
Product
GitHub Copilot Chat
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot Chat rendered images that leaked private source and secrets
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection pull request description
Impact type
Data exfiltration, Secret disclosure, Private source code disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all GitHub Copilot Chat users prior to 2025-08-14
Capability abused
Defense & remediation
Recorded defense
GitHub Content Security Policy plus the Camo image proxy (both turned into the exfiltration channel)
Guardrail kinds
Output filter
Guardrail outcome
Silent
Fix shipped
GitHub disabled image rendering in Copilot Chat and blocked Camo for this path on 2025-08-14
Taxonomy & references
Curator notes
Found by Omer Mayraz (Legit Security), reported June 2025. The injection was hidden in invisible HTML comments in a pull-request description; data was encoded one ASCII character at a time as pre-signed Camo image URLs, defeating CSP with GitHub's own infrastructure. Several outlets misattribute the CVE as CVE-2025-53773 - that is the separate Copilot YOLO-mode RCE recorded elsewhere in this corpus.
Supporting sources
Cite as
Enkrypt AI. "CamoLeak: silent exfiltration of private source code and secrets from GitHub Copilot Chat". AIR, AIR-2025-0145. https://agentincident.vercel.app/i/AIR-2025-0145/ (accessed 2026-10-19).