A malicious filename alone could hijack GitHub Copilot Chat's agent mode

GitHub / Microsoft (Copilot Chat users)·GitHub Copilot Chat (VS Code extension, Agent mode)Disputed

Tenable researchers created a file whose name itself contained instructions addressed to 'GitHub Copilot or another AI assistant'; when the file was present in a workspace, Copilot Chat in Agent mode read the filename as part of its prompt and followed the embedded instructions, including running an attacker-supplied setup.py that exfiltrated a system file to a webhook.

Blast radius

Demonstrated exfiltration of local file contents and arbitrary command execution triggered merely by opening a repository containing the maliciously named files; success was inconsistent due to LLM non-determinism.

Root cause

Copilot Chat concatenates file and directory names into the model's prompt without distinguishing them from trusted instructions, and 'Always Allow' tool-approval settings let agents run commands without per-action review.

How it was caught

Found by Tenable researchers (Ben Smith, Nicholas Miles) through manual testing, disclosed via Microsoft's MSRC.

What changed

Microsoft declined to treat it as a vulnerability, stating the behavior is mitigated by VS Code's existing 'Workspace Trust' feature; no code fix was released.

Take-awayDon't rely on 'Always Allow' auto-approval for agent tool calls in untrusted repositories; filenames and other metadata can carry prompt injection just like file contents.