It wasn't a one-off | Security for Copilot Development

A fix that wasn’t shipped: Tenable found a file-name injection in agent mode; Microsoft said “A solution will not be released” and pointed to Workspace Trust (Tenable).
Invisible issue text: Trail of Bits hid instructions in an issue that maintainers couldn’t see, and the cloud agent added a malicious package to a lockfile (Trail of Bits).
Tokens in a pull request: researchers put instructions in HTML comments of an issue assigned to Copilot, and the agent committed its tokens; GitHub called it an “architectural limitation” (Comment and Control).
A Codespace from an issue: Orca showed a malicious issue triggering an injection when a user opened a Codespace from it, exposing the GITHUB_TOKEN; GitHub patched it (Orca).
More CVEs in 2026: Microsoft fixed an agent that ran commands without confirmation in VS Code 1.132.1 (CVE-2026-70335) and a security feature bypass in Copilot Chat 1.123.2 (CVE-2026-45482).

Security for Copilot Development: It wasn't a one-off