CamoLeak. The access path.
A hidden comment in a pull request made Copilot Chat leak private repositories. The attacker needed no token. They needed the victim to read their pull request.
The record
Entry point. pull request or issue body, instructions hidden in GitHub own hidden comment syntax.
The identity in the middle. The reading maintainer own GitHub permissions. Copilot Chat acted under their identity, which is what made private repositories reachable.
What was reached. the Camo image proxy, data encoded as a sequence of pre-signed one pixel image requests.
A hidden comment in a pull request made Copilot Chat leak private repositories.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| pull request or issue body | Entry | instructions hidden in GitHub own hidden comment syntax |
| Copilot Chat | Step | a maintainer asks about the pull request and the buried instructions run as them |
| private repositories | Step | searched for secrets under the victim access |
| the Camo image proxy | Reached | data encoded as a sequence of pre-signed one pixel image requests |
Where a breakpoint would have been
Whose identity the assistant uses. Anybody can open a pull request; only a maintainer can read private repositories. The assistant collapsed that difference by running attacker written text with maintainer access. Separating the privilege of the content from the privilege of the reader is the structural fix.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the CamoLeak incident?
The published path starts at pull request or issue body, instructions hidden in GitHub own hidden comment syntax.
What did it reach?
The last step in the published path is the Camo image proxy, data encoded as a sequence of pre-signed one pixel image requests.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.