Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-003

agent was the target · researcher disclosure · unreviewed

CamoLeak: a hidden pull-request comment makes GitHub Copilot Chat leak private source

An invisible comment in a pull request instructs Copilot Chat to encode private repository content as a sequence of image requests through GitHub's Camo image proxy, exfiltrating source and secrets the victim can access. CVSS 9.6. GitHub disabled image rendering in Copilot Chat.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-10-08 Legit Security publishes CamoLeak; GitHub has mitigated by disabling image rendering in Copilot Chat · Legit Security T2

What defenders can take from it

  1. Hidden content in collaboration artifacts (PR comments, issues) is agent input; render-and-fetch features become covert channels.
  2. A first-party image proxy is still an exfiltration path when an agent controls the URL.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.