Earlier quoted context omitted.
I think there's different conversations happening and I don't think we're having the same conversation. This is the claim by the article: "Vulnerabilities in the GitHub Copilot CLI expose users to the risk of arbitrary shell command execution via indirect prompt injection without any user approval" But this is not true, the author gave explicit permission on copilot startup to trust and execute code in the folder. He…
"With your permission, Copilot may execute code or bash commands in this folder." could be interpreted either way I suppose, but the actual question is "do you trust the files in this folder" and not " do you trust Copilot to execute any bash commands it wants without further permissions prompts ". The risk isn't solely that there might be a prompt injection, Copilot could just discover `env sh` doesn't need a user p…
I think it's a valid observation that we can bypass the coding AI's user prompting gate with the right prompt. That is a valid limitation of LLM supported agentic workflows today.
But that's not what this article claims. The article claims that there was no user approval and no user interaction beyond initial query and that the copilot is downloading + executing malware.
I'm saying this is sensationalized and not a novel technical vulnerability write up.
The author explicitly gave approval for copilot to trust "untrusted repository". Crafted a file which had instructions to do a curl command despite the warnings on copilot start up. It is not operating secretly in yolo mode.
If the claim of the article is "Copilot doesn't gate tool calls with env", I'd have a different response. But I also have to mention, you can tune approved tool calls.