One hidden comment on a GitHub issue can hijack Copilot's coding agent, researchers say

This is one security firm's research write-up, not independently confirmed. It is a demonstration by the researchers, and it does not report any real victims.

What happened

GitHub's Copilot coding agent can be assigned an issue by anyone with write access to a repository. It then works on a fix and opens a pull request. Researchers at BeyondTrust's Phantom Labs say an attacker can hide instructions inside an HTML comment in an ordinary-looking issue comment. The rendered issue looks harmless to the person assigning it, but Copilot still reads the hidden part. They wrapped their payload in the same XML-style tags Copilot uses to receive issue text, which they say got it past an earlier fix for hidden comments.

How the attack works

The hidden payload asked Copilot to pip install a package from the attacker's repository and then run ls. The package replaced the ls command, so running it fetched and launched their malware. Because Copilot's firewall allow-list includes github.com, the malware pushed the stolen tokens to the attacker's own repository. The researchers say this worked nearly 100% of the time in their tests.

What a stolen token can do

With the Copilot token they could push commits to any branch starting with copilot/, and GitHub showed those commits as verified. They also pulled repository and organisation agent secrets out of the runner's environment. Where a repo's copilot-setup-steps.yml file granted extra permissions, a hidden Actions token was in reach too: contents: write let them push to unprotected branches, and id-token: write let them assume a role in their own test cloud account and list its storage buckets. If a repo switches off approval for workflow runs, they say Copilot can escalate to the repo's most powerful token.

What GitHub said

The researchers first reported the takeover in May 2026. GitHub classed the findings as informational. Its position is that no authorisation control was bypassed, because a user with write access has to assign Copilot to the issue. GitHub's own documentation says HTML comments are filtered out before issue text reaches the agent, and that comments from users without write access are never shown to it. The researchers say the behaviour was still present on 15 October, and that they found vulnerable repositories at major organisations, including ones maintained by Microsoft and GitHub.

Our take

This is our opinion. If an agent reads untrusted text while holding real credentials, the text is in charge. Open the raw markdown of a comment before you assign it to an agent, keep Copilot off public repos where you can, keep agent secrets repo-scoped and short-lived, give copilot-setup-steps.yml the bare minimum permissions, and leave workflow approval switched on.