Commands without a prompt: CVE-2025-53773 and CVE-2026-70335 ran commands with the developer’s privileges, which reach every key and token on the machine.
Private code out through the chat: Legit Security’s CamoLeak used Copilot Chat’s image rendering to leak private source code; GitHub fixed it by disabling image rendering in Copilot Chat (Legit Security).
Repository tokens: RoguePilot and Comment and Control both ended with tokens that can push to or read the repository.
Backdoored pull requests: Trail of Bits showed an agent pull request that looked routine but installed attacker code through a lockfile.
More secrets in code: In a sample of about 20,000 public repositories where Copilot is active, GitGuardian found that 6.4% leaked at least one secret, against 4.6% across all public repositories; it reports a correlation, not a proven cause (GitGuardian).
Risks that stay open: the Tenable finding and Comment and Control were not fixed, so the mitigation is yours to apply.