One Copilot model refused. Another leaked secrets about half the time.
Positions the observed inconsistency not as a failure of Copilot’s design, but as evidence that security controls must shift away from trusting models and toward constraining agent capabilities.
View original on reddit.comOverview
A Reddit user reports on Adversa.ai's demonstration of a prompt-injection attack against GitHub Copilot CLI that bypasses filters via ciphertext decryption, revealing inconsistent model-level security behavior across Copilot's underlying models.
TL;DR
- Adversa.ai demonstrated a novel prompt-injection technique using encrypted malicious instructions that Copilot decrypts and executes.
- The same attack succeeded ~50% of the time on one model but was refused by two others — highlighting model-dependent security outcomes.
- The post questions whether model selection should be treated as a security boundary when agents have file access, code execution, and network capabilities.
Key Stats
50%
success rate
Reported success rate of the attack on one tested Copilot model
Questions Answered
Narrative Frame
security framing
Spin Score
40%
Emphasizes architectural responsibility shift; minimizes scrutiny of Copilot’s specific filter implementation, model selection logic, and vendor accountability for inconsistent behavior.
What the story wants you to believe
That inconsistent model behavior proves the model itself shouldn’t be trusted as a security boundary — shifting focus to agent capability controls instead.
What it makes harder to question
Whether Copilot’s specific filter design, model routing logic, or vendor integration choices are responsible for the observed inconsistency.
How the spin works
Combines technical credibility (novel encryption trick) with a systems-thinking pivot (‘controls belong around capabilities’) to make the model-level inconsistency feel like evidence for a broader architectural truth — even though the article provides no data on *why* the models diverged, leaving the root cause unexamined and unattributed.
Who Benefits If This Frame Spreads
Adversa.ai researchers
Credibility as early identifiers of agent-level threat vectors
Framing positions them as identifying systemic gaps rather than just exploiting a transient bug, supporting their research positioning and tooling relevance.
The Frame
Security-conscious technical observer raising foundational questions about agent trust boundaries.
Missing Context
- No disclosure of Copilot version, OS environment, or whether mitigations were tested post-discovery
- No attribution of responsibility to GitHub, Microsoft, or underlying model providers
SpinGraph
How this belief gets built
Claim → Frame → Beneficiary → Gap → AI Risk
Instead of asking why one model failed and others didn’t, the post reframes the issue as proof that relying on any model for security is misguided — making the deeper question of *which* model failed and *why* feel less urgent.
- Claim
One Copilot model completed the malicious chain in about half
One Copilot model completed the malicious chain in about half the tests, while two others refused it.
- Frame
Blame shifts elsewhere
Security-conscious technical observer raising foundational questions about agent trust boundaries.
- Beneficiary
Credibility as early identifiers of agent-level threat vectors
Adversa.ai researchers — Credibility as early identifiers of agent-level threat vectors
- Gap
No disclosure of Copilot version, OS environment, or whether mitigations
No disclosure of Copilot version, OS environment, or whether mitigations were tested post-discovery
- AI Risk
AI may repeat the headline as fact
A new prompt-injection attack bypasses GitHub Copilot's filters by encrypting malicious instructions, with one model failing half the time.
Claim Ledger
| Claim | Evidence | Verification | Risk | Evidence Gaps |
|---|---|---|---|---|
| One Copilot model completed the malicious chain in about half the tests, while two others refused it. | Unattributed report of differential model behavior; no model names, versions, or test conditions specified. | Needs Evidence | Moderate | Model identifiers (e.g., 'gpt-4-turbo', 'Phi-3', vendor-specific variants); Test environment configuration (CLI version, OS, permissions); Raw logs or reproduction steps |
One Copilot model completed the malicious chain in about half the tests, while two others refused it.
evidence: Unattributed report of differential model behavior; no model names, versions, or test conditions specified.
"They tested the same attack against different models behind Copilot and reportedly got very different results: one completed the chain in about half the tests, while two others refused it."
Evidence Gaps
- Model identifiers (e.g., 'gpt-4-turbo', 'Phi-3', vendor-specific variants)
- Test environment configuration (CLI version, OS, permissions)
- Raw logs or reproduction steps
Fact Check Signals
0 of 1 claim matched · confidence: low · checked October 8, 2026
One Copilot model completed the malicious chain in about half the tests, while two others refused it.
Language Heatmap
Loaded terms that carry the frame beyond the facts.
One Copilot model refused. Another leaked secrets about half the time.
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Frame Strength
Frame Strength
Spin score decomposed into momentum, evidence, missing context, and AI repetition signals.
Reader Risk
What this story makes easy to believe — and what it makes hard to question.
Source Role & Intent
Reddit r/artificial · Forum
Counter-Frames
Brand Frame
Security-conscious technical observer raising foundational questions about agent trust boundaries.
Media / Reader Counter-Frame
Framing it as a narrow, fixable filter bypass rather than a systemic architecture flaw.
Regulatory Counter-Frame
Highlighting lack of transparency around model selection and insufficient disclosure of agent permissions as compliance risks under emerging AI governance frameworks.
AI Summary Frame
Omitting the conditional nature of the finding ('one model, half the time') and presenting it as a deterministic Copilot vulnerability.
Missing Voices
Questions Not Answered
- Which specific models were tested (names, versions, vendors)?
- Was the test environment fully disclosed (OS, Copilot version, plugin configuration, local secrets format)?
- Were results peer-reviewed or independently replicated?
Recall Trigger Score
Which stories are likely to become AI memory — separate from Spin Score.
30
Trigger score 15
Triggered by: Major AI entity
Not tracked — low-authority source, weak claim, or no durable entity.
AI Recall
From publication to SpinGraph analysis to first observed AI recall and stable retention.
What AI Will Probably Repeat
"A new prompt-injection attack bypasses GitHub Copilot's filters by encrypting malicious instructions, with one model failing half the time."
Concern: AI may drop the crucial nuance that success varied across models and that the core argument is about capability boundaries — not just 'Copilot is broken'.
-
Published
Oct 7, 2026
-
Ingested
Oct 7, 2026
-
SpinGraph Created
Oct 8, 2026
-
First Observed AI Recall
Pending
Monitoring scheduled
-
Stable Recall
—
Awaiting retention signal
Recall Check Log
No checks yet — recall tracking is opt-in per story.
─── GEOGrow AI Recall Layer ───
AI Recall Tracking
Monitoring scheduled. No LLM recall detected yet.
This story has not yet appeared in tested AI answers. Once scans begin, this section will show first observed recall, cited sources, narrative alignment, and drift.
node_id=sts_one_copilot_model_refused_another_leaked_secrets
Ask AI about this story
Opens with the SpinGraph .md URL and structured context — one click, prompt included.
More from Reddit r/artificial
View all →- Should AI features show an energy cost like cars show fuel use?
- OpenAI's revenue is reportedly $20 billion less than previously projected
- OpenAI Argues Labs Shouldn't Be Liable For AI Agent Hacking
- [ Removed by Reddit ]
- does AI actually need a different kind of interface than a chat box and a phone
- Once we have reliable AI - what use will we have for government or the public sector?
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO