GITHUB COPILOT CHAT FLAW LEAKED DATA FROM PRIVATE REPOSITORIES

Summary from the TLDR InfoSec newsletter

A vulnerability in GitHub Copilot Chat allowed attackers to combine Content Security Policy bypass with remote prompt injection to leak sensitive data from private repositories, including AWS keys and zero-day vulnerabilities. The attack exploited hidden HTML comments and GitHub's Camo proxy system by creating a dictionary of pre-generated Camo URLs for each alphabet character, allowing data to be exfiltrated when victims clicked on malicious URLs. GitHub addressed the issue on August 14 by preventing Camo from being used to leak sensitive user information.