TL;DR: A malicious GitHub Issue can passively prompt-inject Copilot in Codespaces, combine symbolic links with automatic JSON schema fetching, and exfiltrate a privileged GITHUB_TOKEN for repository takeover, according to Orca Security. The attack turns developer content, workspace files, and AI-assisted execution into one identity boundary failure that traditional workspace trust models do not cover.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Orca Security's research: Passive prompt injection in GitHub Codespaces can weaponise Copilot, symlinks, and JSON schema fetches to expose a privileged repository token.
Why it matters: It matters because IAM, PAM, and NHI teams now have to govern assistant-mediated access paths, not just human users and conventional service credentials.
Context
A passive prompt injection attack works when untrusted content is processed automatically by an AI assistant and the assistant follows hidden instructions as if they were part of the normal workflow. In this case, the primary governance failure is the assumption that repository content, issue text, and workspace files remain safe once they enter a developer environment.
GitHub Codespaces adds another layer to that assumption because the environment is already authorised to operate inside the repository and can expose workspace secrets through tooling choices that feel routine to developers. When Copilot is allowed to act on issue context, symlinked files, and automatic schema retrieval, the identity boundary shifts from human intent to assistant-mediated execution.
That makes this a governance problem across NHI, agentic AI, and developer access controls at once. The starting position is not atypical: many engineering teams trust the workspace perimeter and treat AI assistance as an overlay rather than a privileged execution path.
Key questions
Q: What breaks when hidden prompt injection is allowed in AI code assistants?
A: The assistant can treat attacker-controlled text as instruction, then combine file access, command execution, and output channels to steal secrets or carry out unsafe actions. The failure is not only model confusion. It is a broken trust boundary between repository content and privileged assistant behaviour, especially when the assistant can act inside a developer workstation.
Q: Why do assistant-readable workspace tokens increase takeover risk in Codespaces?
A: Because the assistant can combine file access, outbound requests, and token visibility inside one session. A token that seems limited to a repository can still become a full compromise path if the assistant can read it and use it before any human notices. Short-lived, narrowly scoped credentials reduce that blast radius.
Q: What are the signs that developer AI tooling is crossing a trust boundary?
A: Look for automatic content ingestion, hidden file references, remote retrieval triggered by file contents, and assistant actions that can touch secrets or outbound endpoints. Those signals show that the tool is no longer just suggesting code. It is participating in the identity and access path.
Q: How should teams govern Copilot and Codespaces together?
A: They should govern them as a shared execution environment with joint controls for input validation, file-system reach, token scope, and network egress. If those controls are managed separately, the combined workflow can create a path that neither team sees in isolation. The goal is to limit what the assistant can read, create, and exfiltrate inside the workspace.
Technical breakdown
How passive prompt injection hijacks Codespaces context
Passive prompt injection occurs when an attacker embeds instructions in content that a model later ingests without a direct attacker session. In GitHub Codespaces, a repository issue can be presented to Copilot as contextual input the moment the workspace opens, which means the assistant is already operating inside an untrusted text stream. The important technical point is that the model is not compromised in the traditional sense. Instead, the workflow gives attacker-controlled content a path into assistant decision-making, and that decision-making can then steer actions inside the workspace and related tooling.
Practical implication: treat issue, PR, and repository text as untrusted input to AI assistants, not as inert collaboration data.
Why symlinks and schema fetching create an exfiltration path
The attack chain combines two ordinary development features: symbolic links and automatic JSON schema retrieval. A symlink can point to a sensitive file outside the visible workspace, and if a tool later follows that file reference in a permitted context, the hidden target becomes reachable. Separately, JSON files with a $schema property can trigger outbound fetches to a remote endpoint, carrying attacker-chosen parameters. Together, these features convert local file visibility into external data exfiltration without requiring a classic file download or obvious copy operation.
Practical implication: review whether developer tooling can follow links or fetch remote schemas from files created or touched by assistants.
How a privileged GITHUB_TOKEN becomes a repository takeover
A GITHUB_TOKEN issued to a Codespaces workspace is not just another environment variable. It is a repository-scoped authenticator that can often read and write within the project context, which is enough to turn assistant-controlled actions into privileged changes. If the assistant can be induced to read a secret and then embed that secret into a schema fetch or similar outbound request, the attacker receives credentials that outlive the initial prompt injection event. At that point, the breach is no longer about assistant misbehaviour alone. It becomes credential abuse inside a trusted developer environment.
Practical implication: scope workspace tokens tightly and assume any assistant-readable secret can become an external exfiltration channel.
Threat narrative
Attacker objective: The attacker wants a privileged repository token that can be used to take over the target codebase and manipulate its contents.
- Entry occurs when a malicious GitHub Issue is opened in a way that Codespaces and Copilot will automatically process as workspace context.
- Credential access follows when the attacker steers the assistant toward a symlinked file and a secret reachable inside the Codespaces runtime.
- Escalation occurs when the assistant is induced to create or process a JSON file that triggers remote schema retrieval carrying the stolen token.
- Impact is repository takeover through reuse of the exfiltrated GITHUB_TOKEN against the foreign repository.
Breaches seen in the wild
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Prompt injection is now an identity boundary problem, not just a content safety problem: When untrusted repository text can steer an assistant that already has workspace authority, the effective trust boundary moves from user intent to runtime interpretation. That means IAM and NHI controls have to account for assistant-mediated execution paths, not only authenticated human sessions. The practitioner conclusion is that AI-enabled developer tooling must be governed as a privileged identity surface.
Workspace tokens create a blast radius larger than their apparent scope: A repository-scoped token still becomes high impact when an assistant can read secrets, trigger outbound fetches, and act on files inside the same environment. The control failure is not that a token existed, but that it remained usable across multiple trust boundaries inside the Codespaces session. Practitioners should treat short-lived, narrowly segmented workspace credentials as a minimum assumption for any AI-assisted dev environment.
Automatic retrieval features need identity-aware guardrails: JSON schema downloads, symlink traversal, and AI tool calls each look harmless in isolation, but together they form a cross-feature exfiltration chain. This is a classic example of the identity blast radius expanding through ordinary developer ergonomics. The practitioner conclusion is that tool permissions, file-system reach, and network egress must be evaluated as one control plane.
Passive prompt injection exposes the weakness of static workspace trust models: Workspace security assumptions were designed for humans and deterministic automation, not for an assistant that can reinterpret content at runtime. That assumption fails when the actor is an AI assistant because the trigger, decision, and action all happen inside one session without a human review point. The implication is that access review thinking must shift from who opened the workspace to what the assistant was allowed to do once inside it.
Named concept: assistant-mediated repository compromise: This article shows a pattern where AI assistant context, workspace file access, and outbound schema requests combine into a single compromise path. It is not enough to secure the repository or the model separately, because the exploit lives in the coupling between them. Practitioners should evaluate any AI-enabled development workflow as a compound identity system with shared failure modes.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
- Read next: Enterprise AI Copilot Security Guide
What this signals
Assistant-mediated repository compromise: This incident shows that AI-assisted development can collapse content trust, file trust, and credential trust into a single exploitation path. When assistant output can trigger file reads and outbound requests, the security boundary is no longer the repository alone. Practitioners need controls that govern the assistant as an active participant in the identity plane, not as a passive productivity layer.
Codespaces-style environments should now be reviewed for how they handle untrusted content, symbolic links, and schema retrieval together. If a workspace can read hidden files and send data out automatically, the blast radius is defined by tool coupling rather than by any single setting. That is why 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
For practitioners
- Harden assistant input boundaries Treat issue text, pull request descriptions, comments, and workspace files as untrusted inputs to AI tooling, even when they are native to the repository workflow.
- Disable or constrain remote schema fetching Review JSON and editor settings that allow automatic schema downloads, especially in environments where assistants can create or modify files.
- Block symlink traversal to sensitive paths Prevent workspace tools from following symbolic links into shared runtime files, secret stores, or any path outside the intended repository boundary.
- Scope workspace tokens to the smallest viable privilege Assume an assistant can read anything the workspace token can reach, then reduce token scope, lifetime, and write capability accordingly.
- Audit Codespaces and copilot workflows for outbound paths Check whether assistant-triggered file creation, schema retrieval, or CLI actions can send repository data to external endpoints without review.
Key takeaways
- Passive prompt injection turns ordinary repository content into an execution path when an AI assistant is allowed to act on it inside a workspace.
- The exploit chain matters because symbolic links and automatic schema fetching can move hidden data out of the workspace without a conventional file export.
- Teams should govern developer AI tooling as a privileged identity surface, with stricter token scope, file-system boundaries, and outbound request controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Copilot is steered into unsafe tool actions through injected workspace content. |
| Recommendation — Constrain agent tool use so untrusted repository content cannot trigger file reads or outbound requests. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The attack exfiltrates a workspace secret from the Codespaces environment. |
| NHI-04 — Insecure Authentication | The stolen GITHUB_TOKEN is an authenticator used beyond its safe boundary. | |
| NHI-10 — Human Use of NHI | The exploit relies on a human-facing development workflow using machine credentials in the background. | |
| Recommendation — Treat assistant-readable tokens as secret leakage exposure and remove them from long-lived workspace scope. Limit the authentication power of workspace tokens so compromise does not equal repository takeover. Separate human workflow convenience from machine credential privilege and review where assistants can act on both. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article shows credential capture followed by outbound exfiltration. |
| Recommendation — Map the workflow to credential access and exfiltration tactics to prioritise detection and containment. | ||
Key terms
- Passive Prompt Injection: Passive prompt injection is when malicious instructions are embedded in content that an AI system will later process automatically. The attacker does not need direct chat access. The risk comes from treating untrusted text as operational guidance inside a workflow that can trigger tool use, file access, or network requests.
- AI-Mediated Execution: AI-mediated execution is work where a human initiates action but an AI system helps generate, transform, or carry out the next steps. In identity governance, this creates a mixed control problem because the user owns the session while the machine amplifies the behaviour.
- Workspace Token: A workspace token is a credential issued to a cloud development environment so it can access repository resources on behalf of the user or session. In AI-enabled workspaces, that token becomes high-value because the assistant may be able to read, create, or export it if guardrails are weak.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 9, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org