VV-018criticalData leakage2025-10-08
CamoLeak: Copilot Chat leaked private source code
Legit Security reported a critical vulnerability in GitHub Copilot Chat that could leak private source code from a user’s repositories.
What it is
Legit Security published the finding, which it named CamoLeak, on 8 October 2025.
How to check
- Nothing to patch on your side; the issue was in GitHub’s hosted service.
- Be wary of asking Copilot Chat to summarise pull requests or issues written by outsiders.
How to fix
- Treat any content from outside contributors as untrusted input to the assistant.
Sources
More advisories for this tool