Prompt injection via markdown comments

[llucax]

Select Topic Area

Product Feedback

Copilot Feature Area

Copilot in GitHub

Body

I bumped into this report about performing prompt injection by using hidden markdown comments:

https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code

It says GitHub remediation was to just disable rendering of images in the chat. While this prevents the silent exfiltration, it doesn't prevent the prompt injection, which can lead to malicious responses.

I did a few tests and it wasn't hard to craft some prompt injection that will suggest the user to install malicious packages as suggested in that article. This type of prompt injection still exists in Copilot Chat.

Copilot Coding Agent docs mentions this issue](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent#risk-prompt-injection-vulnerabilities) and says hidden characters, including hidden markdown comments, are not fed to the agent, so I wonder why this is not also done for all chats:

Risk: Prompt injection vulnerabilities

Users can include hidden messages in issues assigned to Copilot or comments left for Copilot as a form of prompt injection. To mitigate this risk, GitHub:

• Filters hidden characters before passing user input to Copilot: For example, text entered as an HTML comment in an issue or pull request comment is not passed to Copilot.

It seems crazy to me that a third party can do prompt injection without me ever seeing the injected instructions. The fix seems pretty trivial (not feeding invisible data to models) and implemented in other Copilot products and I can't see any single reason why anyone would like models to see invisible stuff.

So, why? Why was the "sanitation" of comments not done for Copilot chat (but it is for the agent, or at least that's what it is claimed in the docs) when this issue was reported, and only image rendering was disabled?

Are there any plans to improve this in the very near future? Without this, I don't think I will ever be able to use the chat on any public repo (or any repo where I don't fully trust anyone that can submit comments).

Thanks.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[armorer-labs]

This is a very real trust-boundary problem, especially once markdown stops being only "display text" and starts flowing into review summaries, issue triage, code suggestions, or agent/tool context.\n\nA useful mental model is: markdown comments are another untrusted input channel, just like retrieved docs or tool output. The interesting question is not only "can the model read it?" but "what can that text influence next?"\n\nWe have had the best results by scoring text at the boundary where it crosses into action: retrieved content, tool results, generated tool arguments, outbound messages. That makes it easier to say things like "this comment can be summarized, but it cannot silently authorize a command / secret disclosure / sensitive repo mutation."\n\nI work on Armorer Guard at Armorer Labs, and this exact class of markdown-hidden or formatting-mediated injection is one of the reasons we prefer structured reason labels plus deterministic policy mapping before side effects.