CamoLeak prompt injection in GitHub Copilot Chat silently exfiltrated private code and secrets
A CVSS 9.6 vulnerability dubbed CamoLeak allowed attackers to embed hidden prompts in pull request descriptions using HTML comment syntax, which GitHub Copilot Chat then executed under the victim's permissions. The injected instructions directed Copilot to encode private source code and secrets as sequences of Camo-proxied image URLs, bypassing GitHub's Content Security Policy and silently exfiltrating data to an attacker-controlled server. The flaw was discovered in June 2025 by Omer Mayraz of Legit Security and reported via HackerOne, with GitHub deploying a fix on August 14, 2025.
CamoLeak turned GitHub's own image proxy into a one-character-per-pixel exfiltration channel by having Copilot render stolen secrets as invisible ASCII art images.
Key facts
- What
- A CVSS 9.6 vulnerability dubbed CamoLeak allowed attackers to embed hidden prompts in pull request descriptions using HTML comment syntax, which GitHub Copilot Chat then executed under the victim's permissions.
- Incident date
- Jun 1, 2025
- Who
- GitHub
- Failure mode
- Prompt Injection
- AI surface
- Copilot
- Severity
- Catastrophic
What happened
An attacker embedded hidden instructions inside a pull request description using HTML comment syntax that GitHub Copilot Chat processed as context. When a victim viewed the PR with Copilot Chat active, the injected prompt instructed the LLM to read private source code and secrets from the victim's repositories and encode them as sequences of Camo-proxied image URLs. GitHub's Camo proxy then fetched each character-mapped URL from the attacker's server, allowing full reconstruction of the stolen data with no visible indication to the victim. The vulnerability was reported to GitHub via HackerOne in June 2025 and fixed on August 14, 2025 by disabling image rendering in Copilot Chat and blocking Camo URL usage.
What broke inside the model
- 01 · TriggerAn attacker hides instructions in HTML comments inside a pull request.
- 02 · Model stepCopilot Chat reads the PR and executes the hidden instructions as if from the user.
- 03 · Control gapPR content enters the model unsanitized; the data channel is the command channel.
- 04 · FailureThe injected prompt encodes private code and secrets into pre-signed Camo image URLs.
- 05 · ConsequenceSecrets exfiltrate silently through GitHub's own image proxy.
GitHub Copilot Chat failed to sanitize hidden HTML comments in pull request Markdown before feeding the content to the LLM, allowing injected prompts to override the model's behavior. The Camo image proxy, designed to safely render external images by rewriting URLs with cryptographic signatures, was repurposed as an exfiltration channel because the attacker pre-generated a dictionary of valid Camo URLs mapped to every ASCII character. Copilot rendered the stolen data as invisible pixel images, and the Camo proxy faithfully fetched each URL from the attacker's server, reconstructing the exfiltrated content server-side.
What it cost
Sources
- PrimaryCamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Codelegitsecurity.com
- PressGitHub Copilot Chat Hit by 'CamoLeak' Flaw Exposing User Datapetri.com
- PrimarySafeguarding VS Code against prompt injectionsgithub.blog
Cite this entry
https://failureindex.ai/failures/camoleak-prompt-injection-github-copilot-chatAI Failure Index. "CamoLeak prompt injection in GitHub Copilot Chat silently exfiltrated private code and secrets" (FI-0098). Realm Labs. https://failureindex.ai/failures/camoleak-prompt-injection-github-copilot-chat (indexed Jun 4, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0098. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.