The problem
What Copilot can reach
In agent mode, Copilot can run any terminal command you approve, with your full user permissions and network access unless the agent sandbox is on (VS Code docs). That includes ~/.ssh, ~/.aws and every .env file your account can open.
What Copilot reads matters as much as what it runs. Your settings, a trusted folder’s .vscode/ files, MCP servers, .github/copilot-instructions.md, AGENTS.md, hooks and repository CLI settings all instruct or execute, and every issue, file name, web page and tool result can carry instructions aimed at the model.