Documented incidentPublished 2025-08-12GitHub Copilot usersResearch paper

Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)

Instructions planted in content the agent reads could make GitHub Copilot write "chat.tools.autoApprove": true into the project's .vscode/settings.json, which turns off all user confirmations.

What happened

  • With confirmations off, the agent could run shell commands and browse the web without approval, leading to full compromise of the developer's machine on Windows, macOS and Linux.GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
  • The researcher noted the general pattern: an agent that can write files and change its own configuration or security settings can escalate to code execution; Microsoft fixed it in the August 2025 Patch Tuesday release.GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)

The failure pattern

Indirect prompt injection changes agent behaviorAn email, web page, issue or ticket that the AI reads contains instructions, and the agent follows them with its tools.How to prevent it AI action exceeds its intended scopeAn AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.How to prevent it Privileged action without an enforceable approval gateLimits and approvals live in a prompt, a UI checkbox or a convention instead of code the automation cannot bypass.How to prevent it
Watch the pattern: Indirect prompt injection changes agent behavior

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Never let an agent change its own permissionsProtect agent configuration and security settings from the agent's file-writing tools, and require a human to change approval modes.
  • Treat repository content as untrusted inputContent the agent reads must not be able to trigger tool calls without the same confirmation as any other risky action.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern

Security advisory2026-10-16AI system

Software component issue could allow unintended commands to run

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users…

Indirect prompt injection changes agent behaviornvd.nist.gov
Security advisory2026-10-16AI agent

Software component issue could allow unintended commands to run

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

Indirect prompt injection changes agent behaviornvd.nist.gov