AI SECURITYLABS

Security for Copilot Development: What goes wrong

Part 3 of 16

What goes wrong

Most serious findings against Copilot share one pattern: text the agent reads persuades it to weaken its own protections or run a command. The main risks are:

  • Approvals switched off: global auto-approve, Bypass Approvals or a CLI allow-all flag removes every confirmation.
  • Repository configuration: a project ships .vscode/settings.json, MCP servers, instruction files or hooks that change what the agent does.
  • Injected instructions: issues, comments, file names and MCP output steer the agent, including the cloud agent working alone.
  • Secret exposure: the agent reads tokens or .env files and sends them out through the network, a tool or a pull request.
  • Extension supply chain: MCP servers, extensions and plugins are third-party code running with your rights.