Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

legitsecurity.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#31

Post by frumplestlatz »

trenchpilgrim wrote: post #30
frumplestlatz wrote: post #29

Earlier quoted context omitted.

Banning VSCode — instead of the troublesome features/plug-ins — seems like a step too far. VSCode is the only IDE that supports a broad range of languages with poor support elsewhere, from Haskell to Lean 4 to F*. I work at a major proprietary consumer product company, and even they don’t ban VSCode. We’re just responsible for not enabling the troublesome features.

> VSCode is the only IDE that supports a broad range of languages with poor support elsewhere I just checked Zed extensions and found the first two easily enough. The third I did not, since they don't seem to have a language server, just direct integrations for vim/emacs/vsc.

Not all the integrations are equal in quality/usability, and in the case of F*, the VSCode extension is by far the most advanced.

I switch between Emacs, VSCode, JetBrains IDEs, and Xcode regularly depending on what I am working on, and would be seriously annoyed if I could not use VSCode when it is most useful.

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#33

Post by munchlax »

oefrha wrote: post #14
lyu07282 wrote: post #12

Earlier quoted context omitted.

> GitHub fixed it by disabling image rendering in Copilot Chat completely.

To supplement the parent, this is straight from article’s TLDR (emphasis mine): > In June 2025, I found a critical vulnerability in GitHub Copilot Chat (CVSS 9.6) that allowed silent exfiltration of secrets and source code from private repos, and gave me full control over Copilot’s responses, including suggesting malicious code or links. > The attack combined a novel CSP bypass using GitHub’s own infrastructure with…

Take a chill pill.

I did, in fact, read the fine article.

If you did so too, you would've read the message from github which says "...disallow usage of camo to disclose sensitive victim user content"

Now why on earth would I take all the effort to come up with a new way of fooling this stupid AI only to give it away on HN? Would you? I don't have a premium account, nor will I ever pay microsoft a single penny. If you actually want something you can try for yourself, go find someone else to do it.

Just to make it clear for you, I was musing on the chord of being able to write out the steps to exploitation in plain english. Since the dawn programming languages, it has been a pie-in-the-sky idea to write a program in natural language. Combine that with computing on the server end of some major SaaS(s) and you can bet people will find clever ways to circumvent safety measures. They had it coming and the whack-a-mole game is on. Case in point TFA.

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#34

Post by belter »

isodev wrote: post #27
hansmayer wrote: post #23

Earlier quoted context omitted.

Just out of interest, what is your alternative IDE?

That depends a bit on the ecosystem too. For editors: Zed recently added the disable_ai option, we have a couple of folks using more traditional options like Sublime, vim-based etc (that never had the kind of creepy telemetry we’re avoiding). JetBrains tools are OK since their AI features are plugin based, their telemetry is also easy to disable. Xcode and Qt Creator are also in use.

Did you look at VSCodium ?

https://vscodium.com/

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#35

Post by aitchnyu »

isodev wrote: post #26
aitchnyu wrote: post #25

Earlier quoted context omitted.

What do your CLIs connect to? To first-party OpenAI/Claude provider or AWS Bedrock?

Devs are free to choose, provided we can vet the model prover’s policy on training on prompts or user code. We’re also careful not to expose agents to documentation or test data that may be sensitive. It’s a trade off with convenience of course, but we believe that any information agents get access to should be a conscious opt-in. It will be cool if/when self hosting claude-like LLMs becomes pragmatic.

What do you think about AWS Bedrock with Sonnet/R1/Qwen3?

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#36

Post by lyu07282 »

munchlax wrote: post #33
oefrha wrote: post #14

Earlier quoted context omitted.

To supplement the parent, this is straight from article’s TLDR (emphasis mine): > In June 2025, I found a critical vulnerability in GitHub Copilot Chat (CVSS 9.6) that allowed silent exfiltration of secrets and source code from private repos, and gave me full control over Copilot’s responses, including suggesting malicious code or links. > The attack combined a novel CSP bypass using GitHub’s own infrastructure with…

Take a chill pill. I did, in fact, read the fine article. If you did so too, you would've read the message from github which says "...disallow usage of camo to disclose sensitive victim user content" Now why on earth would I take all the effort to come up with a new way of fooling this stupid AI only to give it away on HN? Would you? I don't have a premium account, nor will I ever pay microsoft a single penny. If you…

> If you did so too, you would've read the message from github which says "...disallow usage of camo to disclose sensitive victim user content"

They use "camo" to proxy all image urls, but they in fact did remove the rendering of all inline images in markdown, removing the ability to exfil data using images.

> Now why on earth would I take all the effort to come up with a new way of fooling this stupid AI only to give it away on HN?

You just didn't make it very clear that you discovered some other unknown technique to exfil data. Might I encourage you to report what you found to Github?

https://bounty.github.com/

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#37

Post by elevation »

isodev wrote: post #21

I’m so happy our entire operation moved to a self hosted VCS (Forgejo). Two years ago, we started the migration (including client repos) and not only we saved tones of money on GitHub subscriptions, our system is dramatically more performant for the 30-40 developers working with it every day. We also banned the use of VSCode and any editor with integrated LLM features. Folks can use CLI based coding agents of course,…

With 30-40 devs each pulling a repository to their local machine, how do you prevent even one of them from accidentally exposing the entire repo to an LLM instead of “selected sources”?

And if a user were reluctant to tell you (fearing the professional consequences) how would you detect that a leak has happened?

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#39

Post by munchlax »

lyu07282 wrote: post #36
munchlax wrote: post #33

Earlier quoted context omitted.

Take a chill pill. I did, in fact, read the fine article. If you did so too, you would've read the message from github which says "...disallow usage of camo to disclose sensitive victim user content" Now why on earth would I take all the effort to come up with a new way of fooling this stupid AI only to give it away on HN? Would you? I don't have a premium account, nor will I ever pay microsoft a single penny. If you…

> If you did so too, you would've read the message from github which says "...disallow usage of camo to disclose sensitive victim user content" They use "camo" to proxy all image urls, but they in fact did remove the rendering of all inline images in markdown, removing the ability to exfil data using images. > Now why on earth would I take all the effort to come up with a new way of fooling this stupid AI only to giv…

I'm not sure how you could arrive at the conclusion that I've discovered any technique involving copilot whatsoever.

Feel free to spout more nonsense. I was somewhat puzzled and dismayed at first, but now it amuses me.

Re: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

#40

Post by arielcostas »

twisteriffic wrote: post #28

This exploit seems to be taking advantage of the slow token-at-a-time pattern of LLM conversations to ensure that the extracted data can be reconstructed in order? Seems as though returning the entire response as a single block could interfere with the timing enough to make reconstruction much more difficult.

What if you made it generate a URL with each character-position instead of just the character? For example, instead of making `hacked` be `0.0.0.0/h`, `0.0.0.0/a` and so on; it invokes `0.0.0.0/1-h`, `0.0.0.0/2-a`... that way you can sort them and delete any duplicate calls
Post reply on HN