They called it EchoLeak, and it earned a CVE: CVE-2025-32711.

The vulnerability combined two attack primitives — prompt injection and data exfiltration — into a single devastating chain. An attacker could plant specially crafted content in a repository (code comments, documentation, issue descriptions) that would poison Copilot's context. Once poisoned, Copilot would echo private source code into its responses, which could be captured by attacker-controlled endpoints.

The attack was elegant in its simplicity: you didn't need access to the target's machine or their Copilot account. You just needed them to open a repository containing the payload. Copilot did the rest — reading the poison, processing it as context, and dutifully exfiltrating whatever the attacker requested.

Hack The Box's research team demonstrated the full kill chain, showing how a single malicious file in a public repo could compromise the private code of anyone who cloned it and used Copilot.

The supply chain attack surface just expanded: your AI assistant reads your code, and now attackers can read your assistant.