Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

Gbhackers •Divya • April 10, 2026

A high-severity flaw in GitHub Copilot Chat recently allowed attackers to silently steal sensitive data like API keys and private source code. Tracked as CVE-2025-59145 with a critical CVSS score of 9.6, this vulnerability required no malicious code execution. Instead, hackers used a clever prompt injection technique known as “CamoLeak.” A security researcher publicly disclosed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Copilot Chat Vulnerability Allows Data Exfiltration via CamoLeak A high-severity vulnerability in GitHub Copilot Chat, tracked as CVE-2025-59145, was disclosed on April 10, 2026. This flaw, with a CVSS score of 9.6, enabled attackers to exfiltrate sensitive data from private repositories without executing malicious code. The attack method involved a prompt injection technique known as 'CamoLeak,' allowing the theft of source code, API keys, and cloud secrets. Organizations using GitHub Copilot Chat are at risk, as the vulnerability affects the integrity of their private data. The flaw was publicly disclosed by a security researcher, raising awareness of the potential exploitation. As of now, no patches have been reported to mitigate this vulnerability. Security teams are urged to assess their use of GitHub Copilot and monitor for any suspicious activity. The vulnerability was published on September 15, 2025, but its exploitation has only recently come to light. 2 sources 66

Extracted Entities

Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)