{
 "id": "TR-2026-003",
 "status": "published",
 "title": "CamoLeak: a hidden pull-request comment makes GitHub Copilot Chat leak private source",
 "date": "2025-10-08",
 "window": "Disclosed 8 Oct 2025; GitHub mitigated in August 2025",
 "ai_role": "target",
 "category": "red_team",
 "summary": "An invisible comment in a pull request instructs Copilot Chat to encode private repository content as a sequence of image requests through GitHub's Camo image proxy, exfiltrating source and secrets the victim can access. CVSS 9.6. GitHub disabled image rendering in Copilot Chat.",
 "attacker": {
  "description": "Security researchers (Legit Security), proof of concept"
 },
 "defender": {
  "description": "GitHub — disabled image rendering in Copilot Chat"
 },
 "scale": "Private source and secrets reachable by the victim account",
 "impact": "Exfiltration of private repository content",
 "tactics": [
  "TA0005",
  "TA0009",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-10-08",
   "text": "Legit Security publishes CamoLeak; GitHub has mitigated by disabling image rendering in Copilot Chat",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "Hidden content in collaboration artifacts (PR comments, issues) is agent input; render-and-fetch features become covert channels.",
  "A first-party image proxy is still an exfiltration path when an agent controls the URL."
 ],
 "models_named": [],
 "related_agents": [
  "github-microsoft-github-copilot-coding-agent"
 ],
 "vendor_response": "GitHub mitigation (image rendering disabled in Copilot Chat), August 2025",
 "sources": [
  {
   "title": "CamoLeak: critical GitHub Copilot vulnerability leaks private source code",
   "url": "https://legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code",
   "outlet": "Legit Security",
   "date": "2025-10-08"
  }
 ],
 "reviewer": null,
 "checked_on": null
}