# GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)

Prompt injection in GitHub Copilot Agent Mode writes chat.tools.autoApprove:true to settings.json, enabling YOLO mode and arbitrary shell command execution on the developer's machine.

- Payout: Research
- Severity: high
- Program: GitHub
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-12
- CVE: CVE-2025-53773
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-github-copilot-remote-code-execution-via-prompt-injection
- Tags: area:ai domain:ai domain:desktop impact:integrity impact:rce kind:research platform:research sev:high tech:llm technique:chained technique:unicode-normalization vuln:prompt-injection vuln:rce

**Target:** VS Code GitHub Copilot Agent Mode / .vscode/settings.json
**Root cause:** Copilot Agent Mode can write files to the workspace without user approval, including security-relevant config like .vscode/settings.json. Setting chat.tools.autoApprove:true disables all tool confirmations, letting the agent run shell commands autonomously.
**Steps:**
1. Plant prompt injection in a source file, web page, GitHub issue, or MCP tool response (optionally invisible Unicode text).
2. Injection instructs Copilot to write `"chat.tools.autoApprove": true` into `~/.vscode/settings.json` (file/dir created if absent).
3. Copilot enters YOLO mode, disabling all user confirmations.
4. Injection issues a terminal command, using conditional prompt injection to select OS-specific payload.
5. Arbitrary code executes on the developer host (e.g. calculator, malware download, C2 join).
**How found:** Noticed Copilot Agent Mode writes files to disk immediately without approval (not in-memory diffs). Hypothesized this could escalate privileges, then searched VS Code features depending on workspace-folder settings and found chat.tools.autoApprove, an experimental-but-default feature enabling YOLO mode.
**Exploitation:** Attacker delivers prompt injection via any content Copilot ingests. Copilot writes autoApprove to settings.json, enters YOLO mode, then runs attacker-chosen shell commands without confirmation, achieving RCE. Demonstrated joining a C2 botnet and self-propagating via infected repos.
**Escalation:** Self-propagating AI virus: after RCE, malware embeds instructions into other Git projects/RAG sources and commits/force-pushes upstream, spreading to other developers. Also can overwrite other agents' config files (allow-lists, MCP servers) and .vscode/tasks.json.
**Insight:** When reviewing AI agents, check whether the agent can write to files that control its own permissions or security settings (settings.json, tasks.json, MCP configs, other agents' allow-lists). Self-modification of config is a direct path to RCE.