Adversa AI published an October 6, 2026 report describing a Cryptographic Context Injection test against GitHub Copilot CLI. The researchers say a web page carrying encrypted instructions could cause the coding agent to read local files and send their contents to an attacker-controlled destination.
The researchers describe a bounded setup: the user asked the CLI to fetch an external page, the CLI was in autopilot mode with broad permission, and a permissive model handled the session. They explicitly do not claim a universal one-click compromise or a confirmation-prompt bypass.
Adversa reports that one tested model, mai-code-1.1-flash, ran the full chain in 50 percent of its runs. Two tested GPT-5.6 models refused the same payload. These are results from the researchers' tests, not a measured failure rate across the whole Copilot user base. We did not independently reproduce the test.
The report says the team submitted the finding to GitHub's bug bounty program on September 17 and that, as of October 1, triage had validated the finding but declined to classify it as a vulnerability because the user had given the agent broad autonomous permissions. That is Adversa's account of the exchange; we did not open the private triage record.
Concrete attack payloads are withheld in the report. The finding concerns how a coding agent handles untrusted page content, not proof of an ongoing breach of developer accounts. Restricting file access and outbound actions remains relevant even when text-only injection checks reject an attack.
Source: Adversa AI research report, October 6, 2026.