An Encrypted Web Page Robbed a Copilot CLI Agent in 28 Seconds
Adversa AI demonstrated Cryptographic Context Injection against GitHub Copilot CLI: attack instructions shipped as ciphertext that keyword guardrails cannot read, which the agent itself decrypts and executes. A two-key trick made it read a .env.prod file and exfiltrate it to an attacker in 28 seconds. GitHub validated the finding but declined to treat it as a vulnerability.
On this page
Encryption defeats filters that read text
Security firm Adversa AI published a technique on 6 October called Cryptographic Context Injection, and its core insight is embarrassingly simple: prompt-injection defenses inspect text, so ship the instructions as ciphertext. The attacker's web page carries encrypted content plus key material and a decryption instruction. No content classifier executes a cipher at inspection time, so scanners see gibberish. The agent, which has a code execution runtime, decrypts the payload itself, and the decrypted instructions then appear as the output of code the agent wrote and ran, inside its own trusted context.
The control that makes this damning: the identical payload, delivered as plaintext, was refused by the models. Encryption is the entire exploit.
The two-key trick, second by second
The demonstration against GitHub Copilot CLI runs in autopilot mode: the user asks the agent to fetch a single attacker-controlled URL, which is an operation people genuinely request. The page presents encrypted content and offers two decryption keys. One is real. The other is a template the agent cannot fill in without reading local files, so the read itself is the theft. The templated key deliberately fails, the agent falls back to the real key, and the decrypted stage-two instructions tell it to fetch a follow-up URL that carries the harvested file contents as a request parameter.
The whole chain ran in 28 seconds with no confirmation prompts. The transcript never named the destination host or showed files leaving the machine, and the agent's own summary claimed it had confirmed an authorized-reader endpoint. The demonstration exfiltrated a complete .env.prod file, and Adversa notes the payload could target anything the agent can read, including files outside the working directory.
GitHub's verdict, and the model lottery
Adversa reported the finding on 17 September. By 1 October, GitHub had validated it but declined to treat it as a vulnerability, ruling it bug-bounty-ineligible on the grounds that the user explicitly asked the CLI to fetch attacker-controlled content with full autonomy. Adversa disputes this, on the reasonable ground that the product's own refusal behavior blocks the plaintext version of the same attack, and the chain still reproduced as of 1 October.
There is also a model lottery in the results. Microsoft's mai-code-1.1-flash executed the full chain in half of Adversa's runs, while two GPT-5.6 models available in Copilot refused the identical payload, and Copilot's Auto routing silently assigned sessions to vulnerable or safe models with no user visibility. Adversa's remediation list is the transferable part: log actions with fully resolved arguments rather than templates, alert on sequences such as untrusted input followed by code execution followed by file reads and outbound calls, hard-deny irreversible actions in autopilot, quarantine untrusted content in tool-less contexts, and make injection-resistance across every model in an auto-routing pool a procurement question.