GitHub Copilot RCE via Prompt Injection

GitHub Copilot (VS Code)

Prompt injection in code comments enables "YOLO mode" - disabling all confirmations and executing privileged shell commands

Copilot processes untrusted content from code comments as instructions; no safeguard against config modification