BeyondTrust Phantom Labs (Tyler Jespersen) shows a still-working chain (confirmed present as of Oct 15, 2026): an HTML-comment / Copilot-XML payload in a GitHub issue comment that looks empty to a human but is parsed by Copilot (<comments>, <agent_instructions>, etc.). When a user with write access assigns the issue to Copilot, the agent can be steered to install a malicious package that overwrites ls, exfiltrates the Copilot ghs_ installation token (via github.com, which is on the agent firewall allow-list), and scrape repository/org agent secrets from the ephemeral runner environment. The stolen token can push auto-verified commits to any copilot/-prefixed branch. If copilot-setup-steps.yml grants contents: write or id-token: write, attackers can escalate to a privileged Actions token or mint OIDC JWTs for AWS/Azure/GCP role assumption. GitHub classified the reports Informational, arguing assignment by a write-privileged user is an authorization boundary the user must police. Do now: edit/copy-markdown every comment before assigning Copilot; disable Copilot on public repos; minimize copilot-setup-steps.yml permissions; require workflow-run approval; extra reviewer on Copilot PRs; pin cloud OIDC sub claims; scope/rotate agent secrets.