Copilot decrypted the payload and treated it as instructions

Adversa AI, a security firm, published a write-up on 6 October 2026 describing a chain it calls cryptographic context injection. The setup begins with a page the user asks Copilot CLI to fetch while the tool runs in autopilot, the mode that executes actions without step-by-step approval. The page carries an encrypted payload together with instructions. The page presents two candidate decryption keys; Copilot decrypts the payload inside its own shell with the real one, and treats the plaintext as trusted instructions rather than as content from an untrusted page.

The theft is staged before any decryption succeeds. The page's two candidate decryption keys are presented as things the agent must prepare before it can decrypt, and one of them is a template the agent cannot fill in without first reading local files. Building it folds the files' contents into the key string, and the reads reach environment files and files outside the working directory. Decryption with that key then fails by design, and the agent falls back to the real one. The decrypted second stage directs it to fetch a follow-up URL to grab more context, and that request carries the already-harvested contents as a parameter to an endpoint the attacker controlled. Adversa reports the full chain completed in 28 seconds with no confirmation prompt, and that no point in the transcript names the destination host or indicates that file contents left the machine. Delivered as plaintext, the same instructions were caught as prompt injection and refused; encryption, Adversa writes, is the only thing that gets them through.

The chain's success depended on the model handling the session. Adversa reports that Microsoft's own mai-code-1.1-flash executed the chain in 50 percent of runs, while two GPT-5.6 models refused the identical payload.

On the paid account Adversa tested, the vulnerable model was not the default and had to be selected by hand; on an account left on Auto, the router assigned the vulnerable model on some sessions and a safe one on others, and the user does not choose, and does not see, which model handled the session.

GitHub's bounty team validated the finding but declined to treat it as a vulnerability, after which Adversa disclosed it. The write-up is the firm's own research, and the corroborating coverage is a secondary report.

The chain requires autopilot mode and a model willing to act on the decrypted instructions, so it does not describe an exploit against every Copilot CLI session. Adversa presents it as a reproduction rather than as evidence of use in the wild, and no independent reproduction by a third party was reported.

A GitHub spokesperson told The Register the attack "requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability." The maker of the affected tool disputes that the behaviour is a vulnerability, and Adversa's disclosure section closes with the note that the chain still reproduces as described.