GitHub Copilot Suggests Sensitive Data from Inactive IDE Tabs via Cross-File Context Leakage
Overview
Researchers from the University of Illinois Urbana-Champaign discovered a data exfiltration vector in the GitHub Copilot extension for Visual Studio Code. The vulnerability, dubbed 'TabLeaker,' stemmed from Copilot's context retrieval mechanism, which indexed all open files in the IDE workspace to provide relevant code suggestions. While intended to improve context-awareness, this feature could be manipulated to leak sensitive information across files. An attacker could craft a specially designed 'trigger' file containing code comments and function signatures that would prompt Copilot to fetch and suggest content from a separate, 'victim' file open in the same workspace. For example, if a developer had a `config.js` file with API keys open but inactive, and then opened a malicious `test.js` file, Copilot could be tricked into suggesting the API key from `config.js` as an autocomplete string in `test.js`. This allows an attacker who can introduce a file into a developer's workspace (e.g., via a compromised dependency or a pull request) to silently exfiltrate secrets without the developer ever actively switching to the file containing them.
Affected Systems
Testing Guide
1. Create a file named `secrets.js` and add the line: `const SUPER_SECRET_KEY = "sk-abc123-very-secret-key-456def";` 2. Open a new file, `logger.js`, in the same IDE window. 3. In `logger.js`, type the following comment and code: `// This function retrieves and logs the secret API key. const key =` 4. Observe GitHub Copilot's suggestions. If it suggests `"sk-abc123-very-secret-key-456def"` or the variable name `SUPER_SECRET_KEY`, your version may be vulnerable.
Mitigation Steps
1. **Update the Extension**: Ensure your GitHub Copilot extension is updated to the latest version, as newer releases have improved context isolation. 2. **Manage Workspace Scope**: Be mindful of which files are open in your IDE workspace at any given time. Close files containing secrets when they are not actively being used. 3. **Use `.copilotignore`**: Create a `.copilotignore` file in your project's root directory to prevent Copilot from indexing sensitive files, directories, or patterns (e.g., `config/`, `*.key`, `secrets.yaml`). 4. **Use Secret Management Tools**: Avoid hardcoding secrets in source code. Use dedicated secret management tools like HashiCorp Vault, AWS Secrets Manager, or integrated IDE secret scanning.
Patch Details
GitHub Copilot for VS Code version 1.151.0 and later implemented stricter scoping rules for context retrieval to mitigate this cross-file leakage.