The RoguePilot flaw was a critical AI-driven vulnerability in GitHub Codespaces (discovered by Orca Security) that allowed attackers to perform a full repository takeover by exploiting GitHub Copilot.

The attack chain worked as follows:

• Passive Prompt Injection: Attackers embedded malicious instructions within a GitHub Issuedescription.
• Automatic Processing: When a developer launched a Codespace from that specific issue, the in-environment Copilot agent automatically processed the issue text as its initial prompt.
• Environment Exploitation: The injected instructions forced Copilot to locate the GITHUB_TOKEN environment variable, which provides read/write access to the repository.
• Data Exfiltration: The attacker used a combination of repository symbolic links to reach sensitive runtime files and abused the automatic JSON schema download feature in VS Code.
• Stealthy Delivery: By appending the token data to a schema URL, the sensitive information was exfiltrated to the attacker’s server without requiring user approval or triggering security alarms.

GitHub has since patched this vulnerability after being notified by researchers.