A file-edit approval can fail if it checks the original filename but overlooks where the file will be moved. Hacktron AI's May 13 report describes this flaw in GitHub Copilot Chat's patch tool: the confirmation logic examined files being added or updated, while the actual edit also processed a destination path supplied by a move operation.
The researchers describe using that mismatch to modify sensitive configuration and trigger command execution. An issue-based attack required a maintainer to start AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → mode and a model with access to the affected tool. The failure connects prompt injectionAn attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.Full definition → to an ordinary software boundary: the tool needed to authorize the destination it actually wrote to.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
