# Source Code and data exfiltration via Github Copilot

Prompt injection in GitHub Copilot Chat on untrusted repos caused hidden image/link rendering, exfiltrating workspace source code to attacker domains.

- Payout: hidden
- Severity: low
- Program: GitHub
- Found by: astrounder
- Disclosed: 2024-08-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2383092
- Library page: https://bugbountylibrary.com/r/h1%3A2383092
- Tags: area:ai domain:ai domain:desktop impact:data-leak kind:bounty platform:hackerone sev:low tech:llm technique:chained vuln:prompt-injection

**Target:** Copilot Chat client interfaces (VS Code, JetBrains)
**Root cause:** Copilot Chat insecurely renders model output, allowing injected instructions in workspace files to emit attacker-controlled image links and hidden HTML that leak data via URL parameters.
**Steps:**
1. Clone/place an untrusted repository containing hidden prompt-injection instructions in files.
2. Open Copilot Chat in VS Code/JetBrains and invoke it on that workspace so injected content enters context.
3. Injected instructions make Copilot emit markdown image links to attacker domain with workspace data in URL params.
4. Client renders image, sending request with exfiltrated data to attacker server.
5. Also inject hidden HTML tags (e.g. `<h1>`) to conceal payload from victim.
**How found:** Researcher observed Copilot Chat renders HTML tags and images from model output, hypothesized injected workspace content could steer output to attacker-controlled URLs carrying data.
**Exploitation:** Attacker plants indirect prompt injection in a repo; victim runs Copilot Chat on it; Copilot generates image/link markdown pointing to attacker domain embedding sensitive workspace contents in URL parameters, which the client auto-renders/fetches, exfiltrating data.
**Escalation:** Chained direct and indirect injection with hidden HTML rendering to conceal payloads; extended from image-link exfil to link-based exfil requiring more user interaction.
**Insight:** LLM chat clients that auto-render markdown images/links turn any indirect prompt injection into a zero-click exfil channel via URL query params; test hidden HTML rendering to conceal payloads from the user.