A stranger writes a GitHub issue.
A developer clicks “Code with agent mode.”
Copilot reads the issue and does what the stranger said.
VS Code had patched this. We found a way around the patch.
Your agent can’t tell your instructions from an attacker’s.
The full breakdown:
A GitHub issue written by a stranger can steer Copilot AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → mode even after VS Code's patch. Treat issue and PR text as untrusted input to any coding agent.
Terms in this piece · Glossary
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
