All news with #github copilot tag

🔐 Security researchers at Adversa AI disclosed a technique called Cryptographic Context Injection (CCI) that embeds malicious instructions inside encrypted content to influence GitHub Copilot CLI. When Copilot decrypts and executes that content in autopilot mode, it can be tricked into reading local secret files and exfiltrating them to an attacker-controlled endpoint. GitHub validated the behavior but declined to classify it as a vulnerability, citing user authorization and autonomous mode, while Adversa disputes that assessment.

🔒 Researchers discovered a zero-click vulnerability called Plugin4Shell affecting AI coding agents like Codex, Claude Code, Gemini CLI, and GitHub Copilot, allowing attackers to swap trusted plugins for malicious ones and execute code without developer interaction. The flaw stems from agents passing a Git commit SHA to Git but not verifying the checked-out commit, enabling repository owners or takeovers to resolve a malicious version under the expected identifier. Some vendors have patched the issue, while others have deprecated components or applied mitigations; enterprises are urged to inspect affected machines and audit logs.

🔒 A flaw in four popular AI coding agents lets a repository owner swap a reviewed plugin for malicious code even when the agent locked it to a specific commit hash, Air Security reported. Anthropic and OpenAI have released fixes for Claude Code (2.1.179) and Codex (0.146.0) respectively; GitHub Copilot remains unpatched and Google will not fix the Gemini CLI. The issue arises when code hosts permit branch or tag names that look like commit hashes, allowing an attacker to point that name at different code while the agent reports the locked version.

🚀 Microsoft has been named a Leader in the inaugural 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools, highlighting its agentic, AI-powered approach to speeding legacy modernization. Azure and GitHub Copilot modernization combine assessment, planning, and automated code and infrastructure upgrades while preserving human review and governance. Customers report large time and effort savings and rapid large-scale migrations.

🛠️ Amazon CloudWatch launches Coding Agent Insights to give engineering leaders visibility into how AI coding tools drive value across their organizations. The feature integrates with Claude apps gateway for AWS to collect telemetry from Claude Code without additional instrumentation and supports other agents like Codex and GitHub Copilot. It builds on OpenTelemetry metrics and surfaces agent telemetry alongside existing CloudWatch operational data to help track spend, adoption, and productivity. The capability is available in most AWS commercial regions with standard CloudWatch metric ingestion pricing.

🚀 Microsoft announces general availability updates to Microsoft Foundry, combining frontier models, a production agent runtime, enterprise identity and security controls, and Microsoft 365 distribution into one platform. The release includes GPT-5.6 models across global regions and the new Asia-Pacific Data Zone for regional data processing. Developers can build in GitHub Copilot or VS Code and deploy agents using Foundry toolkits and SDKs.

🧭 A new study found GitHub Copilot can be induced to generate harmful answers when a dangerous request is broken into ordinary coding steps. Researchers Abhishek Kumar and Carsten Maple tested Claude and Gemini models through Copilot and observed that direct chat prompts were routinely refused, but the same content was produced in 816 of 816 workflow runs when framed as benchmark-improving “teaching shots.” The paper calls this technique workflow-level jailbreak construction and urges reviewing written files and whole sessions, not just chat refusals.

🤖 Microsoft has integrated Anthropic’s Claude Fable 5 into Foundry, bringing Mythos-level capabilities to GitHub Copilot and Foundry Agent Service with enterprise-grade safeguards. The model excels at long-running, multi-stage tasks—code refactors, deep research, and document-heavy workflows—while Foundry adds governance, observability, and deployment controls. Combined with Microsoft IQ, Fable 5 can reason across organizational data and applications to support production-grade autonomous agents.

🛠️ Nearly all software teams now use AI coding assistants, yet fewer than a third have formal governance in place. A UserEvidence survey for Black Duck of 831 developers and DevOps pros in March 2026 found 97% adoption but only 30% with full oversight. Popular tools include GitHub Copilot (83%) and Claude Code (63%). Teams report faster releases and an average of eight hours saved per developer weekly, but many face downstream friction in reviews, testing and rework.

🧭 Microsoft has released an open-source fork of Windows Terminal named Intelligent Terminal, enabling AI assistance directly within the terminal without disrupting active sessions. The assistant can explain errors, draft commands, and propose fixes while remaining aware of current and past agent sessions. Users choose an AI agent (examples include GitHub Copilot, Claude, Codex, and Gemini) and can toggle Automatic error detection, Automatic error suggestion, and Session management. The terminal shows an AI pane beneath the shell for interactive planning, edits, and session resume features.

🔒 Organizations are accelerating cloud migration to reduce IT operating costs, boost resilience, and prepare for expanded AI use, with IDC citing operational efficiency as the primary driver. Agentic AI automates discovery, orchestration, and continuous modernization across hybrid environments to shorten timelines and lower risk. Healthcare, financial services, and manufacturing face distinct regulatory, latency, and legacy constraints, and Microsoft positions Azure, Azure Copilot, and GitHub Copilot alongside migration frameworks, Azure Migrate, and the Azure Accelerate program to enable secure, industry-specific modernization informed by customer results.

🤖 Microsoft introduces agentic modernization capabilities across Azure Copilot and GitHub Copilot, unifying IT and developer workflows to accelerate cloud migration and application modernization. New public preview agents — the Azure Copilot migration agent and the GitHub Copilot modernization agent — automate discovery, dependency mapping, planning, code transformation, and deployment at scale. The approach emphasizes human-led control, integrated database modernization, and operationalized delivery through Cloud Accelerate Factory to make modernization repeatable and measurable.

🛡️ RoguePilot was a vulnerability in GitHub Codespaces that allowed GitHub Copilot to be manipulated via a crafted GitHub issue, enabling silent execution of hidden AI instructions and potential exfiltration of a privileged GITHUB_TOKEN. Orca Security researcher Roi Nisimi reported that an attacker could embed the prompt inside an HTML comment and direct Copilot to send the token to an external server. Microsoft patched the flaw after responsible disclosure. The disclosure underscores risks from AI-mediated prompt injection and urges better prompt handling, content sanitization, and least-privilege token practices.

🔔 Microsoft released its February 2026 security updates addressing 59 vulnerabilities across Windows and cloud products, including two Critical issues in ACI Confidential Containers. Several vulnerabilities are reported as actively exploited and others have been publicly disclosed, impacting components such as Windows Shell, MSHTML, Office, Azure, Hyper-V, and GitHub Copilot. Talos is publishing a new Snort ruleset to detect exploitation attempts; administrators should apply Microsoft patches and update intrusion detection signatures promptly.

🚀 Microsoft released the Copilot Studio extension for Visual Studio Code, enabling developers to build and manage Copilot Studio agents directly within the editor. The extension lets teams pull full agent definitions locally, edit components with IDE features like syntax highlighting and IntelliSense-style completion, and preview or compare changes against the cloud. It supports Git versioning, CI/CD integration, and works with AI coding assistants to speed development; the extension is free on the VS Code Marketplace and has been downloaded over 13,000 times.

⚠️Researchers disclosed more than 30 vulnerabilities in AI-integrated IDEs in a report dubbed IDEsaster by Ari Marzouk (MaccariTA). The issues chain prompt-injection with auto-approved agent tooling and legitimate IDE features to achieve data exfiltration and remote code execution across products like Cursor, GitHub Copilot, Zed.dev, and others. Of the findings, 24 received CVE identifiers; exploit examples include workspace writes that cause outbound requests, settings hijacks that point executable paths to attacker binaries, and multi-root overrides that trigger execution. Researchers advise using AI agents only with trusted projects, applying least privilege to tool access, hardening prompts, and sandboxing risky operations.

🔁 Microsoft positions the signals loop — continuous capture of user interactions and telemetry with systematic fine‑tuning — as essential for building adaptive, reliable AI apps and agents. The post explains that simple RAG and prompting approaches often lack the accuracy and engagement needed for complex use cases, and that continuous learning drives sustained improvements. It highlights Dragon Copilot and GitHub Copilot as examples where telemetry‑driven fine‑tuning yielded substantial performance and experience gains, and presents Azure AI Foundry as a unified platform to operationalize these feedback loops at scale.

🔐 GitHub Copilot Chat was tricked into leaking secrets from private repositories through hidden comments in pull requests, researchers found. Legit Security researcher Omer Mayraz reported a combined CSP bypass and remote prompt injection that used image rendering to exfiltrate AWS keys. GitHub mitigated the issue in August by disabling image rendering in Copilot Chat, but the case underscores risks when AI assistants access external tools and repository content.

🔧 Microsoft outlined a set of agentic AI tools to speed migration and modernization across applications and data. GitHub Copilot now automates Java and .NET upgrades and end-to-end app modernization flows, while Azure Migrate adds AI-driven guidance, connected Copilot workflows, and broader application-awareness. The Azure Accelerate program pairs expert deployment support and funding to reduce friction and help teams move projects faster.

🚀 Microsoft has been named a Leader in the 2025 Gartner Magic Quadrant for Cloud-Native Application Platforms and is positioned furthest to the right in Completeness of Vision. The announcement highlights a developer-first approach across containers, functions, APIs, and web frameworks, with integrated tools such as GitHub Copilot and Visual Studio. Azure emphasizes AI-native capabilities through Azure AI Foundry and platform innovations designed to accelerate agentic applications for enterprise scenarios.