By inserting malicious Copilot instructions into a GitHub issue, unscrupulous actors could have taken advantage of a vulnerability in GitHub Codespaces to take over repositories.
Orca Security has given the vulnerability caused by artificial intelligence (AI) the nickname RoguePilot. After responsible disclosure, Microsoft has since patched it.
According to a revelation by security researcher Roi Nisimi, attackers can create concealed instructions inside a GitHub issue that GitHub Copilot automatically processes, allowing them silent control of the in-codespaces AI bot.
When a malicious command is placed in data or content that the large language model (LLM) processes, it might result in arbitrary actions or unexpected outputs. This vulnerability has been characterized as an read more about RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.