Case camoleak-copilot-chatPrompt injectionUnited States
CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets
Legit Security found a CVSS 9.6 flaw where invisible markdown comments in pull requests steered Copilot Chat to read private repositories and exfiltrate secrets character by character through GitHub's Camo image proxy.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 9, 2025
- Location
- United States
- Target
- GitHub Copilot Chat
- Severity
- Critical
- Triggered by
- Omer Mayraz (Legit Security)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Legit Security found a CVSS 9.6 flaw where invisible markdown comments in pull requests steered Copilot Chat to read private repositories and exfiltrate secrets character by character through GitHub's Camo image proxy.
Impact: Proof of concept exfiltrated AWS keys, tokens and the description of an undisclosed zero-day from a private repository; the attack could also push malicious packages via Copilot suggestions
Who triggered it
Actor: Omer Mayraz (Legit Security)
Attribution: Responsible disclosure through HackerOne in June 2025
Motive: Security research
How it happened
Attack vector: Prompt injection in invisible pull request or issue comments; Copilot acts with the viewer's permissions and encodes stolen data as a sequence of pre-generated Camo image URLs that bypass CSP
Root cause: Copilot Chat consumed hidden comment content as instructions and could render images through the trusted Camo proxy, creating a covert exfiltration channel
Timeline
- Legit Security reports the flaw to GitHub via HackerOne
- GitHub disables image rendering in Copilot Chat to close the Camo channel
- Public disclosure of CamoLeak
Response
GitHub disabled all image rendering in Copilot Chat and blocked use of Camo for leaking user content
Current status: Patched
Sources (open in a new tab)
- Legit Security legitsecurity.com
- The Register theregister.com
- eSecurity Planet esecurityplanet.com
Cite this case
CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets. AI Threat Watch, case camoleak-copilot-chat, Oct 9, 2025. https://aithreat.io/cases/camoleak-copilot-chat/
Permanent link: https://aithreat.io/cases/camoleak-copilot-chat/