Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets

Adversa AI says GitHub Copilot CLI can leak local secrets through a cryptographic prompt-injection attack when it fetches attacker-controlled content; its test of Microsoft's mai-code-1.1-flash completed the attack chain in 50% of attempts, while two tested OpenAI GPT-5.6 models refused it. Researchers said Auto model selection could assign the vulnerable model without the user seeing which model handled a session. GitHub validated the report but declined to classify it as a product vulnerability, arguing the user must direct the CLI to fetch untrusted content and confirm the action; Adversa says the attack still works as described.

Analysis

The market-relevant issue is less a demonstrated breach than a governance gap: if model routing changes security behavior without making that choice visible to administrators, enterprises cannot reliably set or audit controls for agentic coding. That can slow Copilot adoption in sensitive development environments and push buyers toward tools with clearer model pinning, permission boundaries, and audit logs; Anthropic and other coding-agent providers benefit only if they can demonstrate those controls, not merely claim safer models.

For Microsoft, this is a contained product-trust risk, not evidence of compromise across GitHub or its broader cloud business. The exploit requires a chain of user-directed actions and the reported success is model-dependent, limiting near-term financial inference. The second-order risk is that conservative customers disable autonomous features, reducing usage and weakening the productivity case that supports premium AI seats. Stronger safeguards could also add friction, inference expense, or latency.

Near term, likely noise unless independent replication or a real customer incident emerges. Over 1–3 months, watch for model-pinning/default changes, enterprise policy controls, and whether security teams treat agentic coding as a procurement blocker. Over 6–18 months, auditable execution boundaries may become a competitive requirement across coding agents. The thesis weakens if Microsoft makes routing transparent and constrains secret access/network egress by default, or if enterprise adoption and Copilot usage remain unaffected. No standalone MSFT trade is justified on this evidence; a product-specific issue is too small to underwrite a directional position absent broader AI adoption or guidance signals.

Key Decisions for Investors

• Do not trade MSFT directionally on the report alone; treat it as a low-confidence product-risk signal, not evidence of a material security incident.
• Monitor Microsoft disclosures and product changes for model pinning, administrator visibility, secret-access controls, and outbound network restrictions; these determine whether the issue becomes enterprise-wide friction or a rapidly contained defect.
• Escalate the thesis if independent researchers reproduce the chain against default enterprise configurations, a customer incident is confirmed, or Microsoft changes Copilot guidance/controls in a way that signals broader exposure.
• Watch for relative positioning opportunities in coding-agent competitors only if they provide verifiable security controls and enterprise wins; absent that evidence, competitor outperformance is not yet a trade.