OpenAI Codex Prompt-Injection Flaw Could Expose GitHub Access Tokens, Researchers Say

Anthropic’s Claude Code is a development environment that uses generative AI to help developers read and write code and operate tools. Prompt injection can override a user’s intent if the system mistakes text in a GitHub repository for trusted instructions. Microsoft said the flaw posed a significant risk because CI/CD systems often hold highly privileged credentials such as deployment keys and cloud tokens.

Microsoft security researchers recently disclosed that attackers could hide malicious prompts in GitHub content, inducing Claude Code to execute unintended commands and send CI/CD credentials to an external destination. Anthropic has patched the flaw. Users of version 2.1.128 and earlier are advised to upgrade immediately to reduce the risk of compromise to software supply chains and deployment environments.

GitHub Copilot and Codespaces import Issue content into cloud development environments to help AI assist with coding, but that process also turns externally controlled text into an attack surface. Orca Security named the passive prompt-injection chain RoguePilot. If an access token were leaked, attackers could read from and write to repositories, potentially compromising CI/CD supply chains and team development environments.

Orca Research Pod researcher Roi Nisimi disclosed the research on February 16, 2026. An attacker could hide instructions in an HTML comment within a GitHub Issue, prompting Copilot to check out a malicious pull request containing a symbolic link. A remote JSON schema could then be used to exfiltrate a GITHUB_TOKEN with read-write permissions. GitHub patched the flaw after it was reported. Orca did not disclose the number of actual victims, any financial losses or a CVE identifier.