GitHub Copilot Vulnerability Enables Remote Code Execution via Prompt Injection

This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer's machine in GitHub Copilot and VS Code.

It is achieved by placing Copilot into YOLO mode by modifying the project's settings.json file.

An attacker can put GitHub Copilot into YOLO mode by modifying the project's settings.json file on the fly, and then executing commands, all without user approval.

This is not uncommon and is an area to always look for when performing a security assessment of AI agents.