PROMPT INJECTION ENGINEERING FOR ATTACKERS: EXPLOITING GITHUB COPILOT

Summary from the TLDR InfoSec newsletter

This post demonstrates a prompt injection attack against GitHub Copilot, where attackers file malicious issues with hidden prompts in HTML `picture` tags, causing Copilot to insert backdoors when assigned to implement fixes. The attack leverages fake conversation history to manipulate the AI agent into secretly executing a malicious bash script disguised as a “security setup,” ultimately installing backdoored dependencies that accept commands via HTTP headers. The technique exploits Copilot's inability to distinguish legitimate from injected XML tags. Maintainers rarely scrutinize package lock file modifications during code review.