Vulnerability
A booby-trapped web page can make GitHub Copilot CLI send a developer's local files to an attacker.
The Cryptographic Context Injection attack hides the instructions in an encrypted text that the agent decrypts in its shell.
The same instructions sent in clear text are detected as prompt injection and refused.
The model mai-code-1.1-flash executed the whole chain in 50% of Adversa's trials, two GPT-5.6 models refused.
GitHub's bug bounty validated the finding but refused to handle it as a vulnerability.