CourseLarge Language Models: The Complete Course · Module 7: Context Engineering · part 53 of 103
Part 53 · Module 7: Context Engineering

Incident: Hidden text steered a coding assistant

10 min read·13 Oct 2026
Module 7 · Incident file · About 30 minutes

What happened

CAMOLEAK, 2025 June found, reported 14 Aug images switched off 8 Oct write-up published 9 Oct The Register a demonstration: no attacks on customers reported
Found in June 2025 (red), mitigated on 14 August by switching a feature off (green), and made public in October.

In June 2025 Omer Mayraz, a researcher at the security company Legit Security, found a flaw in GitHub Copilot Chat, the assistant built into GitHub. He reported it through HackerOne. Legit Security published his write-up on 8 October 2025, and The Register reported it the next day. Everything below comes from those two sources.

Copilot Chat is, in Legit Security's words, "context-aware: it can use information from the repository (such as code, commits, or pull requests) to provide tailored answers." The write-up adds: "As always, more context = more attack surface."

THE SHAPE OF THE FLAW, AS BOXES hidden comment in a pull request Copilot Chat reads raw text private repos user's permissions reply with images data out via Camo
A planted note (red) reaches the model (amber), which reads with the user's permissions (grey) and can send data out through its reply.

Mayraz put instructions for the assistant in a pull request description, first as visible text, then inside a hidden comment. GitHub supports comments that do not show on the page: "invisible comments are an official feature!" Posting one "triggers the usual PR notification to the repo owner, but the content of the hidden comment isn't revealed anywhere." The person reading the page sees nothing; the assistant reads all of it. Another user who asked Copilot Chat to explain the pull request got answers shaped by the hidden text.

The second ingredient was permissions: "Copilot operates with the same permissions as the user making the request." So the hidden instructions could reach that user's private repositories. In his demonstration Mayraz took "the description of a zero-day vulnerability inside an issue of a private project", and had Copilot search a codebase for "AWS_KEY". The data left through GitHub's own image proxy, Camo, in Copilot's reply. He rated it 9.6 on CVSS, the common 0 to 10 severity scale.

GitHub fixed it "by disabling image rendering in Copilot Chat completely", as of 14 August 2025. The Register adds that GitHub blocked the use of Camo to leak content "while a longer-term remediation is developed", and that GitHub did not immediately answer its questions. Neither source reports the flaw being used against customers: it was a demonstration, and the cost on record is a feature switched off.

The rest of this course is yours to keep

This course is bought on its own, once, and stays readable afterwards, including the parts added to it later.

Buy this course · ₹399See what is inside