Security firm Adversa AI showed that an attacker-controlled web page containing encrypted instructions could make GitHub Copilot CLI, running in autopilot mode, read a developer’s .env file and send it to an attacker’s URL. The issue was reported through GitHub’s bug bounty on 17 September 2026 and published on 6 October 2026. GitHub validated the behaviour but declined to classify it as a product vulnerability, saying the user must direct the tool to untrusted content. Success depended on the model: Microsoft’s mai-code-1.1-flash completed the chain in about half of attempts, while two OpenAI GPT-5.6 models refused. Date shown is the public disclosure date.