GitHub Copilot flaw let prompt injection disable command approvals

Prompt injection could change an agent’s permissions

On August 12, 2025, researcher wunderwuzzi disclosed CVE-2025-53773, a prompt-injection flaw in GitHub Copilot Agent Mode for Visual Studio Code. The demonstration showed how malicious instructions in content Copilot processed could change the agent’s tool-approval behavior, allowing it to run terminal commands without the confirmation a user would normally expect. The content could include invisible Unicode characters, making the instruction difficult to notice during a casual review.

The researcher said the issue was reported to Microsoft on June 29. The route matters because agents often inspect code, issues, web pages, and tool output before acting. A hostile instruction in one of those sources can steer the agent away from the developer’s original goal. Microsoft patched it with its August security update. The original write-up describes the behavior, and the MSRC advisory records the fix.

Keep approval outside the model

A coding agent may read repository files, issues, web pages, and tool output written by other people. If any of that content can change its permissions, an ordinary coding task can become a command-execution path. The public report is a proof of concept; it does not report an in-the-wild campaign.

• Enforce command approval in the editor or a separate policy layer the model cannot alter
• Review proposed commands before execution, especially after reading untrusted repository content
• Restrict the agent to a disposable workspace and minimum-needed permissions