GitHub won’t fix it.
Your coding agent can be talked into sending out your .env in 28 seconds.
This week, researchers published “Cryptographic Context Injection” against GitHub Copilot CLI.
How the attack works
The trick: hide instructions in an encrypted blob on a web page. The agent decrypts it in its own shell and treats the plaintext as trusted. Next it reads .env.prod. Then it sends the contents out in a URL request.
No phishing. No malware. Nobody pasted a secret.
It needs autopilot mode and a model that doesn’t refuse. Auto model routing sometimes picks one for you.
GitHub validated the report, then declined to treat it as a vulnerability.
Why no single tool sees it
You can’t wait for every agent vendor to close every path.
A prompt filter sees an encrypted blob. A network tool alone sees a normal web request. An endpoint tool alone sees a file read.
The signal is the connection: the agent read .env, and then that data left the machine.
That’s why Netra watches the endpoint and the network together, so you see what the agent touched and where it went.
Would anything in your environment connect those two events?