GitHub Copilot Chat prompt injection to data exfiltration

What happened

Hidden instructions in untrusted source code that Copilot analyzed could fully control its responses and exfiltrate data by rendering an image tag whose URL carried stolen data to a remote server.

Root cause

Copilot Chat followed injected instructions from analyzed code and rendered remote images, allowing data to leak via the image-request URL.

Fix / outcome

GitHub mitigated by disabling image rendering in Copilot Chat. (Distinct from the more severe 2025 CamoLeak issue.)

Sources