Hidden PR comments make Copilot Chat leak private code through images
CamoLeak: hidden Markdown in a PR could make Copilot Chat search the victim's private repos and leak results via image URLs.
- Agents
- GitHub Copilot Chat
- Reported
- Source checked
- Tags
- copilot, exfiltration, markdown
Symptom
Copilot Chat answers render images you didn't expect while you review a PR from someone else.
Cause
Copilot runs with the victim's permissions and rendered attacker-influenced Markdown. Encoding data into a sequence of image fetches got it past the content security policy.
Fix
GitHub fixed it as of August 14, 2025. In your own agent UIs, don't render remote images or links from model output that has seen untrusted input.
// Strip remote images from model output before rendering
const safe = markdown.replace(/!\[[^\]]*\]\((?!\/)[^)]*\)/g, '[image removed]');