RoguePilot Flaw in GitHub Codespaces Leaks GITHUB_TOKEN via Copilot

• A critical "RoguePilot" flaw discovered in GitHub Codespaces allowed malicious code to bypass security boundaries and exploit GitHub Copilot's prompt processing capabilities.
• This prompt injection vulnerability enabled the Copilot AI assistant to leak sensitive GITHUB_TOKEN values from the Codespace environment, potentially compromising user repositories.
• The attack vector involved manipulating "tainted data flows" within the development environment, highlighting risks associated with AI code assistants interacting with privileged tokens.

Source: The Hacker News | Date: February 26, 2026