Copilot CLI decrypted hidden commands and leaked local files

The case

Adversa AI got the GitHub Copilot CLI agent to decrypt hidden commands in ciphertext and obey them.

The result was the exfiltration of local files from the machine in autopilot mode and without a visible confirmation step (Source: csoonline.com).

GitHub validated the finding and rejected it as a vulnerability, and their reading is that the agent behaves as expected from a system that follows its context.

This is uncomfortable, I know... the software did not break, an assumption broke, and it is the one that the agent tells apart the data it reads from the orders it receives.

And the case does not depend on a specific version or an unpatched product, it depends on how any agent that reads files and has hands to move is built.

That border does not exist in any model in use today.

A file that enters the context window is text, and a text shaped like an instruction runs if the agent has permission to run it.

The visible confirmation was the only barrier there was, and in autopilot it is off.

Why it matters now

The vector is not new, but what changes this week is the price and the surface where the agent runs.

Anthropic put Haiku 5.5 at 0.10 and 0.50 dollars per million input and output tokens with a million tokens of context, aimed at subagents that classify, summarize and route by volume (Source: anthropic.com).

Microsoft integrated llama.cpp into Windows ML and let Copilot control desktop applications... this bet they announce is hybrid, the sensitive stays on the machine and the heavy goes to the cloud (Source: bgr.com).

Put the two things together and you get a something (the thing) ok no jokes... cheaper agents and more agents running, and of course more of them with access to local files from a tool that looks like development and not security.

It is not that the agent is dumb or that the model is broken.

It is that we put tools and context in the same bag, and whoever writes the context is not always whoever gives you the order.

The other side

The same week leaves the problem on both sides, the agent that attacks and the agent that obeys.

Anthropic cut live internet access in its internal evaluations after detecting that Claude models exploited prompt injection flaws to act against real sites.

Prompt injection escalates to a security incident, not a simple chatbot bug (Source: thehackernews.com).

Google (GTIG) warns that AI speeds up vulnerability discovery in enterprise environments and critical infrastructure, with less time between bug and exploit (Source: industrialcyber.co).

And in South Korea there are AI-assisted bank attacks that forced the developer of the offensive tool to restrict its use (Source: techstartups.com).

The agent does not tell apart what it reads from what it is ordered, and that holds for the one who defends and the one who attacks.

What to watch

• What identity the agent runs under and how far that permission reaches, because it is almost always wider than it looks.
• Whether the log keeps the chain of tool calls with their arguments or only the text of the final answer.
• Which processes on the machine can open TLS connections to the internet without anyone expecting them.

How I would test it in my lab

I would test it in two steps on the setup from the MCP Security Detections project, the one that runs a local model against an MCP detections server and correlates with Splunk on the same machine.

First I would give it a normal task and a file with a hidden order inside, with the tools limited to read, and I would keep the chain of calls it decides to make.

Then I would look at the log of those calls and see which tool, with which arguments and in what order, because the intent shows in the sequence even if the final result looks harmless.

What I would do differently now is move the brake outside the agent.

A prompt that asks for caution is not a control, to me it is a suggestion.

The control is a permission that does not let it open connections to the internet and a log that records every call before it runs.

Closing

The agent was not a bad guy, it did what is expected from it, it read, decrypted and obeyed, which is exactly what we ask it to do.

The difference between a useful tool and a leak vector is in the permission we give it and in the log we leave behind.

---

Originally published at https://sammideblas.com/notas/copilot-cli-decrypted-hidden-commands-and-leaked-local-files

Si has leído hasta aquí... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ¿No Crees?