Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

Cybersecuritynews •Abinaya • April 10, 2026

A recently disclosed high-severity vulnerability in GitHub Copilot Chat allowed attackers to silently siphon sensitive data from private repositories. Tracked as CVE-2025-59145 with a near-perfect CVSS score of 9.6, the flaw enabled the theft of source code, API keys, and cloud secrets without requiring the execution of any malicious code. Dubbed “CamoLeak,” this exploit highlights […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Copilot Chat Vulnerability Allows Data Exfiltration via CamoLeak A high-severity vulnerability in GitHub Copilot Chat, tracked as CVE-2025-59145, was disclosed on April 10, 2026. This flaw, with a CVSS score of 9.6, enabled attackers to exfiltrate sensitive data from private repositories without executing malicious code. The attack method involved a prompt injection technique known as 'CamoLeak,' allowing the theft of source code, API keys, and cloud secrets. Organizations using GitHub Copilot Chat are at risk, as the vulnerability affects the integrity of their private data. The flaw was publicly disclosed by a security researcher, raising awareness of the potential exploitation. As of now, no patches have been reported to mitigate this vulnerability. Security teams are urged to assess their use of GitHub Copilot and monitor for any suspicious activity. The vulnerability was published on September 15, 2025, but its exploitation has only recently come to light. 2 sources 66

Extracted Entities

Hackers Exploit GitHub Copilot Flaw to Exfiltrate Sensitive Data

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)