---
title: BeyondTrust: hidden GitHub issue comments can hijack Copilot coding agent, steal tokens/agent secrets, and escalate to CI/CD or cloud | ctxsec
url: https://ctxsec.com/items/beyondtrust-github-copilot-hidden-issue-comment
description: ""
status: "confirmed research (BeyondTrust Phantom Labs Oct 21); GitHub left unpatched as of Oct 15 per authors — treat as opinion on severity vs GitHub's Informational classification"
published: 2026-10-21
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/beyondtrust-github-copilot-hidden-issue-comment.md)

confirmed research (BeyondTrust Phantom Labs Oct 21); GitHub left unpatched as of Oct 15 per authors — treat as opinion on severity vs GitHub's Informational classification

2026-10-21

### BeyondTrust: hidden GitHub issue comments can hijack Copilot coding agent, steal tokens/agent secrets, and escalate to CI/CD or cloud

BeyondTrust Phantom Labs (Tyler Jespersen) shows a still-working chain (confirmed present as of Oct 15, 2026): an HTML-comment / Copilot-XML payload in a GitHub issue comment that looks empty to a human but is parsed by Copilot (`<comments>`, `<agent_instructions>`, etc.). When a user with write access assigns the issue to Copilot, the agent can be steered to install a malicious package that overwrites `ls`, exfiltrates the Copilot `ghs_` installation token (via github.com, which is on the agent firewall allow-list), and scrape repository/org **agent secrets** from the ephemeral runner environment. The stolen token can push auto-verified commits to any `copilot/`-prefixed branch. If `copilot-setup-steps.yml` grants `contents: write` or `id-token: write`, attackers can escalate to a privileged Actions token or mint OIDC JWTs for AWS/Azure/GCP role assumption. GitHub classified the reports Informational, arguing assignment by a write-privileged user is an authorization boundary the user must police. **Do now:** edit/copy-markdown every comment before assigning Copilot; disable Copilot on public repos; minimize `copilot-setup-steps.yml` permissions; require workflow-run approval; extra reviewer on Copilot PRs; pin cloud OIDC `sub` claims; scope/rotate agent secrets.

Sources: [BeyondTrust: How Hidden GitHub Issue Comments Can Hijack Copilot Agents](https://www.beyondtrust.com/blog/entry/github-copilot-hidden-prompt-injection-agent-takeover)