Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.
Technology & Software Engineering Top 100 / #1ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol
Coding agent · commercial · GitHub; VS Code; GitHub

GitHub Copilot coding agent

Deeply integrated coding agent across GitHub workflows and developer tooling. Publisher: GitHub / Microsoft. Also ranked in Business & Enterprise Operations (#1), Government & Public Sector (#5), Cybersecurity (#9).

Vendor page ↗+ CompareExport JSON
Trust profileas of 2026-10-26
Publisherlikely · Repository ownership or inferred publisher domain — resource URL on a domain that carries the vendor's namelikely
Compliance1 record about this agent · 1 registry-matched · +3 vendor-level (inherited)T1
Security36 CVEs linked in the registry · 27 critical/high · newest 2026-09-17linked
ProtocolsModel Context Protocol (MCP) claimed — vendor documentation — "Configure MCP servers for your repository" (GitHub Docs) (checked 2026-10-02) sourceAgent2Agent (A2A) not checked — not probed: URL is on a code host, which never carries a publisher's well-known filesAgentic Resource Discovery (ARD) not checked — not probed: URL is on a code host, which never carries a publisher's well-known files1 / 3
Traces1 public trace · best: vendor report · data left the environment in at least oneT3
Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Publisher unconfirmed: the evidence below is shown but not counted in the governance score, because nothing yet ties this listing to GitHub / Microsoft beyond resource URL on a domain that carries the vendor's name. A vendor-domain page, marketplace listing, ARD manifest or A2A card would confirm it.

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe GitHub / Microsoft, not this agent specifically.

Traces — under attack, in defence, in incidents

1 public · what a trace is
⚠
attacked by a researcher
T3 vendor report · platform-level · unreviewed
An invisible comment in a pull request instructs Copilot Chat to encode private repository content as a sequence of image requests through GitHub's Camo proxy
Observed: Private source and secrets exfiltrated; GitHub disabled image rendering in Copilot Chat · egress: yes · human approval: no · refused: no
Vendor response: GitHub mitigation (image rendering disabled in Copilot Chat), August 2025
Legit Security
2025-10-08

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

36 linked · the registry
CVE-2026-55946
2026-09-17
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Code execution · Data exfiltration · unreviewed
Medium 5.9
CVE-2026-81380
2026-09-08
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose informatio…
Code execution · Data exfiltration · fix known · unreviewed
Medium 5.9
CVE-2026-81381
2026-09-08
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Data exfiltration · Credential access · fix known · unreviewed
High 7.5
CVE-2026-58616
2026-08-28
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information…
Data exfiltration · fix known · unreviewed
Low 3.0
CVE-2026-24301
2026-08-18
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Code execution · Data exfiltration · unreviewed
High 7.5
CVE-2026-65675
2026-08-11
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
Auth bypass · unreviewed
Medium 6.5
CVE-2026-70335
2026-08-11
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate priv…
Code execution · Privilege escalation · fix known · unreviewed
High 7.8
CVE-2026-47282
2026-07-14
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Data exfiltration · Credential access · fix known · unreviewed
Medium 6.5

28 more · All 36 in the registry → Severity is the official record's; nothing here enters the score. Links are by listed product, so a CVE that names a different component of the same platform may be missing.

Compliance evidence

Jurisdiction: US + EU · 6 frameworks shown
✔
FedRAMP · FedRAMP LI-SaaS
T1 Registry-matched
FedRAMP Authorized
Scope: product · covers this resource: partial · FedRAMP Marketplace · 2026-10-26 · match 93%
re-check 2026-11-02
–
ISO 27001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 42001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

3 records matched at organisation level
✔
CSA STAR · STAR Level 2
T1 Registry-matched · vendor-level
found in CSA STAR Registry on 2026-10-26
Scope: entity · CSA STAR Registry · 2026-10-26
re-check 2026-11-02
○
GDPR
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
SOC 2
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 1 vendor-claimed⚠ 0 issues linkedas of 2026-10-26
○ ClaimedVendor-claimed (vendor page, 2026-10-26).
– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.
☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

Nothing linked from Hacker News, GDELT, GitHub releases or the vendor's feed in the last 90 days.

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Technology & Software Engineering score

94
technology profile · sar-score-2.0 · #1 of 100 in the curated list
Adoption / usage30 / 30
Trust & security17 / 25
Project / product health20 / 20
Ecosystem / interoperability15 / 15
Domain expertise / fit100 / 100
Governance / compliance evidence0 / 100
Docs / transparency10 / 10

Raw component / maximum, then weighted by the technology profile (adoption 30, trust 20, project 20, ecosystem 15, domain 10, governance 0, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Deployment questions answered from the vendor's documentation, each with its source.

✔Reads private repositories? Yes — "available in eligible private and internal repositories"; owners can disable it per repository source
✔Executes code or writes changes? Yes — "edit files and run tests and linters in an ephemeral cloud development environment"; "only has the ability to push to a single branch" source
?Credential handling documented? Not documented — Which secrets the agent can read is not stated on the pages checked; the risks page notes it "has access to code and other sensitive information, and could leak it" and that internet access is restricted by a firewall source
✕Can run entirely on your own machine or infrastructure? No — Hosted: works "in a cloud environment rather than your local IDE" source
✔Human approval before consequential actions? Yes — "Draft pull requests created by Copilot cloud agent must be reviewed and merged by a human"; "workflows are not triggered until Copilot cloud agent's code is reviewed" source
Evidence supporting this use (7)
CSA STAR STAR Level 2 — registry-matched, vendor-level source
FedRAMP LI-SaaS — registry-matched source
GDPR — vendor-claimed, vendor-level source
SOC 2 — vendor-claimed, vendor-level source
Reads private repositories: yes — "available in eligible private and internal repositories"; owners can disable it per repository source
Executes code or writes changes: yes — "edit files and run tests and linters in an ephemeral cloud development environment"; "only has the ability to push to a single branch" source
Human approval before consequential actions: yes — "Draft pull requests created by Copilot cloud agent must be reviewed and merged by a human"; "workflows are not triggered until Copilot cloud agent's code is reviewed" source
Unknowns to check (8)
Credential handling documented: not documented — Which secrets the agent can read is not stated on the pages checked; the risks page notes it "has access to code and other sensitive information, and could leak it" and that internet access is restricted by a firewall. Ask the vendor. source
Can run entirely on your own machine or infrastructure: no — Hosted: works "in a cloud environment rather than your local IDE" source
Your lawful basis and DPIA for PHI and personal data the agent will touch
That the SOC 2 report period covers the components you will use; request the report under NDA
Current FedRAMP status with the agency, if government use is intended
Whether the CSA STAR entry covers this product; Level 1 is a self-assessment, Level 2 a third-party attestation
The transfer mechanism you will rely on; DPF covers EU-to-US transfers only
Ask the vendor for ISO 27001, ISO 42001 evidence; none was found in the sources checked
Suggested restrictions for a pilot (3)
Pilot with scoped, short-lived tokens only; keep production secrets out of the agent's environment.
Treat it as a hosted processor: data-flow review and a signed DPA before any private data is in scope.
A public trace shows data leaving the environment under adversarial input. Confirm the vendor's fix is in the version you deploy, and keep an egress allowlist around the agent during the pilot.

See the worked comparison: Three ways to let a coding agent into a private repository →

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category
CSA STAR Registrycompliance evidence
FedRAMP Marketplacecompliance evidence
vendor pageclaims
NVDsecurity (CVE keyword search)
Hacker News, GDELT, vendor feedsnews and chatter
First seen2026-10-26
Recordres_f80a0e1295d21843
Open the full record (JSON) →

Appears in the incident registry

Public traces of this agent (or its platform) attacking or defending a system.

TR-2026-003 CamoLeak: a hidden pull-request comment makes GitHub Copilot Chat leak private source TA0005 · TA0009 · TA0010