CamoLeak: an invisible PR comment turned Copilot Chat into a private-repo exfiltration service

Date

Oct 2025

Tools involved

github-copilot

Impact

CVE-2025-59145, CVSS 9.6; proof-of-concept exfiltrated AWS keys and the contents of a privately stored zero-day description via GitHub's Camo proxy

Root cause

Prompt injection through invisible markdown comments in a pull request, which Copilot Chat ingested as context and treated as legitimate instructions

What happened

In October 2025, Legit Security researcher Omer Mayraz disclosed CamoLeak, tracked as CVE-2025-59145 with a CVSS score of 9.6, a vulnerability in GitHub Copilot Chat. The setup was elegant and nasty: an attacker planted malicious instructions inside a pull request description using GitHub's invisible markdown comment syntax. That text does not render anywhere in the web UI, so a human reviewer sees a normal PR. Copilot, however, still ingests it as context.

When a victim reviewed the PR with Copilot Chat, the AI treated the hidden text as legitimate instructions. The injected prompt directed Copilot to search the victim's private codebase for sensitive strings, things like AWS keys and source files, encode the findings, and embed them in a sequence of pre-signed image URLs.

The exfiltration channel was the clever part, and the source of the name. GitHub routes remote images through its Camo image proxy, a mechanism normally used to serve external images safely. The exploit abused Camo as a data channel, leaking the encoded secrets one image request at a time from inside GitHub's own infrastructure. Mayraz demonstrated proof-of-concept theft of AWS keys and the contents of a privately stored zero-day description.

GitHub mitigated the issue by disabling image rendering in Copilot Chat on August 14, 2025, ahead of the October public disclosure. The Register, Legit Security, and others covered CamoLeak as a striking example of what prompt injection looks like when the injected agent has read access to your private repos and a built-in way to phone home.

Impact

The proof of concept exfiltrated AWS keys and the contents of a privately stored zero-day description from private repositories, which is about as sensitive as repo contents get. The vulnerability scored a CVSS 9.6 and was assigned CVE-2025-59145. The attack required no malware and no compromised credentials: the victim just had to do their job and review a pull request with Copilot Chat. Because GitHub disabled image rendering in Copilot Chat on August 14, 2025, before public disclosure, there is no public record of in-the-wild exploitation, but the technique itself became a reference case for AI-tool exfiltration channels.

Root cause

CamoLeak chained two design gaps. First, Copilot Chat ingested pull request content that never renders to humans: GitHub's invisible markdown comment syntax gave attackers a channel to speak to the AI without the reviewer seeing anything. Second, Copilot's output could trigger network fetches through GitHub's Camo image proxy, so a sequence of pre-signed image URLs became a byte-by-byte exfiltration channel. Either gap alone is a curiosity; together they turned a routine PR review into a private-source-code leak. The underlying disease is treating untrusted repository content as trusted instructions.

How to not be this entry

• Treat every AI assistant with repo read access as a prompt injection target. Anything an outside contributor can put in a PR, an issue, or a README is attacker-controlled input to your AI tools, including text you cannot see rendered.
• Keep secrets out of repositories entirely. CamoLeak's payoff was AWS keys sitting in private repos; if the keys had lived in a secrets manager, the same exploit would have exfiltrated far less. Read the fix guide: Accidentally committed an API key to GitHub
• Audit your AI tools' output channels, not just their inputs. Image rendering, link unfurling, and any markdown-to-network feature is a potential exfiltration path; GitHub's fix here was disabling image rendering in Copilot Chat.
• Scope AI tool access with least privilege. An assistant that can read every private repo you can turns one poisoned PR into organization-wide exposure; narrower access caps the blast radius.

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

Frequently asked questions

Sources

• Legit Security: CamoLeak, critical GitHub Copilot vulnerability leaks private source code
• The Register: GitHub Copilot Chat vulnerability let hidden PR comments steal code
• eSecurity Planet: GitHub Copilot flaw enabled private data theft

Related error guides