Severity
Exposure
Date of incident
Imported item 6
confirmed
Tier -
A
Copilot agent ran injected shell commands — no execution hop blocked local RCE.
What Happened
Copilot agent mode passed unsanitized input to shell commands; researchers demonstrated prompt-injection chains enabling arbitrary local execution without adequate execution-boundary mediation.
Sumarry
Microsoft disclosed CVE-2025-53773 — command injection in GitHub Copilot and Visual Studio allowing local code execution via crafted agent inputs.
Detect
Agent sandbox + deny auto-approve on shell tools
What Happened
Runtime enforce on destructive tool class; disable chat.tools.autoApprove
Blekline //
Block shell tool class at enforce hop unless explicitly allowed
Without agent boundary //
User approves agent commands individually — prompt injection bypasses review
