Ask HN: Any indications Copilot scans your local files?

#1

Post by polycaster » Mon, Nov 08, 2021, 3:08 PM UTC

A client of mine is just about to launch a startup. There's nothing public on the web yet. Today, while hacking a very minimal prototype of a HTML page into VSCode, I got a strange suggestion from GH Copilot. When I entered the client's name Copilot prompted me with a ready-made block containing a marketing claim of their company. So far so nice.

Strange thing is the claim is not public and not contained in the codebase I'm currently working on, in no codebase I know of and to my knowledge, I'm the only related dev using Copilot. It's also not listed on Google, thus I assume it's not leaked somewhere else that could be indexed by GH (which is an assumption of course, but appears likely). But it can be found in a completely separate local folder with project assets that is not published on GH.

The marketing claim is about the length of a tweet and is not exactly generic. It requires understanding of my client's business (which again, cannot be derived from my codebase). So it's not GPT3 output that matches coincidentially.

The GH „About GitHub Copilot Telemetry” page [1] does not indicate that your locale file system is scanned though.

Can anyone explain that or observed a similar phenomenon?

[1] https://docs.github.com/en/github/copilot/about-github-copilot-telemetry

Re: Ask HN: Any indications Copilot scans your local files?

#2

Post by orangepanda » Mon, Nov 08, 2021, 3:22 PM UTC

Yes, other files open in your IDE may also be scanned.

From terms of service [1] (Which I'm sure everyone reads)

> when you edit files with the GitHub Copilot extension/plugin enabled, file content snippets [...] will be shared with GitHub, Microsoft, and OpenAI, and used for diagnostic purposes to improve suggestions and related products. GitHub Copilot relies on file content for context, both in the file you are editing and potentially other files open in the same IDE instance.

[1] https://docs.github.com/en/github/copilot/github-copilot-tel...

Re: Ask HN: Any indications Copilot scans your local files?

#3

Post by dnissley » Mon, Nov 08, 2021, 3:24 PM UTC

Have you tried using github search to see if it's popping up there?

Re: Ask HN: Any indications Copilot scans your local files?

#4

Post by polycaster » Mon, Nov 08, 2021, 3:26 PM UTC

orangepanda wrote: post #2

Yes, other files open in your IDE may also be scanned. From terms of service [1] (Which I'm sure everyone reads) > when you edit files with the GitHub Copilot extension/plugin enabled, file content snippets [...] will be shared with GitHub, Microsoft, and OpenAI, and used for diagnostic purposes to improve suggestions and related products. GitHub Copilot relies on file content for context, both in the file you are ed…

Thanks for the pointer but I don't think this is what happened in my case. I never opened the marketing assets in VSCode. They reside in completely separate folders.

Re: Ask HN: Any indications Copilot scans your local files?

#5

Post by polycaster » Mon, Nov 08, 2021, 3:27 PM UTC

dnissley wrote: post #3

Have you tried using github search to see if it's popping up there?

Not until now, thanks! There are no matches. The claim contains my client's company name. And not even the company name yields any search results.

Re: Ask HN: Any indications Copilot scans your local files?

#6

Post by [deleted] » Mon, Nov 08, 2021, 3:29 PM UTC

[deleted]

Re: Ask HN: Any indications Copilot scans your local files?

#7

Post by catchmeifyoucan » Mon, Nov 08, 2021, 3:29 PM UTC

I think it also reads your clipboard. Yesterday, I had copied something from stackoverflow, and was about to paste it, and it gave me a suggestion before I could even drop it in.

Re: Ask HN: Any indications Copilot scans your local files?

#8

Post by macinjosh » Mon, Nov 08, 2021, 3:29 PM UTC

I don't want to cast any aspersions but could this indicate that the marketing copy was "reused" from a public source?

Or perhaps the writer used their same phrases for two clients?

Re: Ask HN: Any indications Copilot scans your local files?

#9

Post by polycaster » Mon, Nov 08, 2021, 3:33 PM UTC

macinjosh wrote: post #8

I don't want to cast any aspersions but could this indicate that the marketing copy was "reused" from a public source? Or perhaps the writer used their same phrases for two clients?

Unlikely. The claim (which I'm sorry I cannot post here for obvious reasons) is rather specific to my client's business which again is very specific in itself.

Re: Ask HN: Any indications Copilot scans your local files?

#10

Post by lvass » Mon, Nov 08, 2021, 3:36 PM UTC

polycaster wrote: post #4

orangepanda wrote: post #2

Yes, other files open in your IDE may also be scanned. From terms of service [1] (Which I'm sure everyone reads) > when you edit files with the GitHub Copilot extension/plugin enabled, file content snippets [...] will be shared with GitHub, Microsoft, and OpenAI, and used for diagnostic purposes to improve suggestions and related products. GitHub Copilot relies on file content for context, both in the file you are ed…

Thanks for the pointer but I don't think this is what happened in my case. I never opened the marketing assets in VSCode. They reside in completely separate folders.

Are you using Windows? IIRC Microsoft collects a hefty amount of data from your filesystem.