CamoLeak: hidden pull request text could make Copilot Chat leak private code

Timeline

• 2025-08-14. GitHub’s fix is in place, according to the researcher.
• 2025-09-30. Legit Security publishes its findings.
• 2025-10-09. The Register reports on them.

Trigger or entry point

A pull request description with a comment that is invisible on the rendered page but is read by Copilot Chat.

Failure mechanism

Any user who asked Copilot Chat about the pull request had the hidden instructions added to their session, which ran with that user’s access. To get data out past GitHub’s content security policy, the researcher used GitHub’s image proxy, Camo. He prepared one proxy address per character in advance, and the instructions made Copilot output the stolen text as a sequence of invisible images.

Impact

Legit Security rates the issue 9.6 on the CVSS scale. Its examples include private source code, cloud keys and the description of an undisclosed vulnerability from a private issue. No CVE is cited. The severity is potential. The victim did not have to click anything unusual: asking Copilot Chat about the pull request was enough.

Response

GitHub disabled image rendering in Copilot Chat. The Register reports that a longer-term fix was still in development. According to the disclosure, as reported by The Register, GitHub also blocked the use of Camo for sensitive user content.

Mitigations

Image rendering in Copilot Chat stays disabled. Neither source describes the planned longer-term fix.