The attack was invisible. Literally.

CamoLeak exploited a vulnerability in GitHub Copilot's markdown rendering to silently exfiltrate private source code and AWS credentials. The mechanism: specially crafted invisible markdown elements that Copilot would render and execute, but that were completely invisible to the developer looking at their screen.

The attacker could embed exfiltration payloads in code comments, documentation, or any markdown that Copilot processed. When Copilot rendered the content, it would silently transmit sensitive data — including AWS access keys — to attacker-controlled endpoints. The developer saw nothing unusual. No popups. No warnings. Just their normal IDE.

The vulnerability, discovered by Legit Security, demonstrated that AI coding assistants introduce an entirely new class of attack surface: the assistant itself becomes the exfiltration channel. You don't need to compromise the developer's machine. You just need to compromise what the assistant reads.

Your AI assistant is now an attack vector. The code it reads can steal your secrets through it.