Copilot Agent Mode Patch Bypass: Issue Text Becomes Token Theft

Copilot's agent mode in VS Code will read a GitHub issue and act on it: when a maintainer clicks "Code with agent mode" on an issue, a Codespace opens and Copilot runs the issue's description automatically. That is convenient and also dangerous, because anyone can file an issue. An earlier attack used this to turn attacker-written issue text into remote code execution, and Microsoft's fix added a confirmation prompt before Copilot writes sensitive files such as .vscode/settings.json. A write-up from Hacktron, promoted again in an October 13 post, describes getting around that confirmation. Its author says they found the original attack and then asked Hacktron's tool to find a bypass of the patch.

The bypass is a time-of-check to time-of-use gap: the safeguard checks one thing, then the action does another. Copilot applies edits through a patch format where an "Update File" line names a file and an optional "Move to" line renames it. According to the write-up, the code that decides which files need confirmation reads only the Update File and Add File lines, while the code that applies the patch also honors Move to and overwrites the destination. So a patch that looks like it edits a harmless new file can instead be moved onto a sensitive path such as .git/config, with no confirmation, because the check only ever saw the harmless source name. The proof of concept writes a malicious Git sshCommand that sends the GITHUB_TOKEN to an attacker's server and turns on VS Code's automatic fetching, so the next background git fetch runs the command and the token leaks.

A notable limit is that the attack needs a model that has Copilot's patch tool. The write-up says GPT-4.1 works best and that gpt-5-mini and raptor-mini also work, but that Claude models lack the tool, so the realistic version targets users without a paid Copilot plan, who get GPT models by default; premium users whose Copilot might pick a Claude model would not be hit. Neither the write-up nor the October post says whether the bypass has since been fixed, so that status is unknown here. Hacktron's broader point is the one in its post: an agent cannot tell the user's instructions from an attacker's, and untrusted text the agent reads can become commands it runs.