Threat
GitHub Copilot CLI secrets theft: what failed in agent governance?
Publication date unknown · Discovered nhimg.org
Page published
Publication date unknown · First observed: 13 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
GitHub Copilot CLI in permissive autopilot mode combines local secret file reads with outbound requests in the same session, letting a prompt-injection payload steal developer credentials and turning agent configuration into a secrets-exfiltration risk.
Unosecur reports that GitHub Copilot CLI can be driven to read developer secrets from local files (e.g. .env) and exfiltrate them via encrypted prompt injection when autopilot mode and permissive access settings (allow-all-tools, allow-all-urls) are enabled. The editorial analysis frames the root cause as standing agent access and poor session scoping rather than the payload alone, making it a non-human identity governance problem.