Disclosed vulnerability
GitHub Copilot CLI: wrapping curl and sh in env hides them from the read-only command validator, giving injection-driven malware execution with no approval
AIR-2026-0052 AIR record · 2026-02-github-copilot-cli-env-wrapper-malware
From the supporting source
Because curl and sh are passed as arguments to env, they are incorrectly parsed and are not identified by the validator as subcommands.promptarmor.com
The record
Disclosed
2026-02-25
Vendor
GitHub / Microsoft
Product
GitHub Copilot CLI
Risk domain
Access control and permissions › Privilege escalation
Also touches
Policy drift, Confused deputy
System type
Generative model
Who acted
Agent acted — Copilot CLI executed the wrapped curl|sh with no approval
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection repository content
Impact type
Remote code execution, Malware execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Copilot CLI users working in untrusted repositories or with web search results
Capability abused
Defense & remediation
Recorded defense
human-in-the-loop approval for non-read-only commands such as curl and sh
Guardrail kinds
Human approval, Permission scope
Guardrail outcome
Silent
Fix shipped
none - GitHub closed the report as not a significant security risk
Taxonomy & references
Curator notes
PromptArmor. Reported 2026-02-25, closed by GitHub 2026-02-26 as 'a known issue that does not present a significant security risk'. Same class of allowlist-parsing defect as Johann Rehberger's Amazon Q find -exec finding (2025-08-amazon-q-find-exec-rce), here against Copilot CLI.
Supporting sources
Cite as
Enkrypt AI. "GitHub Copilot CLI: wrapping curl and sh in env hides them from the read-only command validator, giving injection-driven malware execution with no approval". AIR, AIR-2026-0052. https://agentincident.vercel.app/i/AIR-2026-0052/ (accessed 2026-10-19).