The key was your .env file

On Tuesday, October 6, Adversa AI published a technique it calls Cryptographic Context Injection, and a demonstration against GitHub Copilot CLI. A developer asks the agent to fetch one URL. Twenty-eight seconds later, "the full contents of a .env.prod file, every secret in it, are sitting in an attacker's log." Adversa's summary of the run: "Full chain: 28 seconds, no confirmation."

The Register ran the story that afternoon, and CSO Online and InfoWorld followed on October 7. Adversa reported the issue to GitHub's bug bounty on September 17. GitHub validated the chain, ruled it "ineligible," and told The Register it "requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability." There is no patch and no CVE.

Six steps from one URL

Adversa's write-up lays out the chain:

1. The developer runs Copilot CLI in a project folder, in autopilot mode, and asks it to fetch a URL.
2. The page says its content is encrypted, tells the agent to decrypt it with Python, and offers two candidate keys.
3. One key is real. The other is a template the agent can only complete by reading local files and folding their contents into the key string. The agent reads .env.prod and builds the key. Adversa calls this read "the theft."
4. Decryption with the built key fails, by design.
5. The agent falls back to the real key. The decrypted second stage tells it to fetch a follow-up URL "to grab more context."
6. The agent requests that URL with the harvested file contents in a request parameter.

The transcript never names the attacker's host or shows that file contents left the machine. The agent's closing summary said it had "confirmed an authorized-reader endpoint."

Why the ciphertext gets through

Copilot refuses the same instructions when they arrive as plain text. Adversa's point is that encryption is what changes the outcome. "Static guardrails read text; they do not run it," Rony Utevsky of Adversa told The Register. Base64 or a substitution cipher can be decoded by a model from memory, and a filter can be trained to spot them. Strong ciphertext is opaque until code runs, and the code runs in the agent's own shell, where its output arrives as a tool result the agent produced itself.

The model in charge matters too. Microsoft's mai-code-1.1-flash ran the full chain in half of Adversa's attempts, and the two GPT-5.6 models Copilot offers refused the payload every time. With model selection on Auto, the router sometimes handed the session to the vulnerable model. In Utevsky's words: "The user does not choose, and does not see, which model handled the session." He calls it a "model lottery."

Adversa disclosed the same technique against Grok in August, where it leaked chat histories. A coding agent pays out more, because a shell, file reads and outbound requests are its ordinary tools.

What 28 seconds reach on a laptop

Adversa's demonstration names one file. The write-up says the pattern "could be anything the agent can read," including files outside the working directory. On a developer's laptop, the agent can read whatever your account can:

• .env, .env.prod and .env.local in every checkout
• ~/.aws/credentials, ~/.config/gcloud, ~/.kube/config
• the gh token and ~/.git-credentials
• the agent's own OAuth token and MCP configs with their bearer tokens
• ~/.ssh/id_ed25519, if the template asks for it

The chain uses three tools every coding agent has: a web fetch, a file read and a Python call. The page asks and the model complies.

The same page in a Bromure machine

In Bromure Agentic Coding, the agent runs inside a Linux VM on your Mac, and every request the VM makes crosses a proxy on the host. Replay Adversa's page in a machine, with any agent that fetches pages and runs Python: Claude Code, Codex, Grok. Give the model the worst odds and let it follow every instruction.

The file holds stand-ins

The demonstration works because .env.prod holds live secrets. A Bromure machine doesn't need them. In the machine's Credentials pane, Import env file… reads your .env.prod, shows each variable with its value masked, and turns it into a credential: recognized names like GH_TOKEN, AWS_SECRET_ACCESS_KEY or ANTHROPIC_API_KEY map to their types, and anything else, like STRIPE_KEY, becomes a generic token scoped to the hosts you list. The real values stay encrypted on the Mac. The VM gets stand-ins under the same variable names, shaped like the real thing: brm_…, ghp_…, sk-ant-api03-brm-…. Your app reads its variables as before, and the proxy puts the real value on the wire only for a request to that credential's host.

Step 3 still runs. The agent reads the file, builds key B and folds in what it found. What it found is a set of strings no server will accept.

The stand-in is a tripwire

A stand-in has one legitimate destination, the host it was minted for. The proxy scans every outbound request, request line, headers and body, for any stand-in headed anywhere else. Step 6 puts the harvested file in a request parameter bound for the attacker's host. The proxy finds a brm_ token on its way to a host it was never minted for, answers HTTP 451, forwards nothing, pauses the VM and opens This environment may have been compromised on the Mac. The alert lists the token preview, the credential's name, the host it belongs to and the host it was sent to.

The detector is always on, whatever the model decides and whatever the agent's summary says. Whichever model drew the session, the request reaches the same check on the host.

The decrypted text crosses the proxy

Encryption beats filters that read the page, because the page is ciphertext. The decrypted second stage still has to reach the model, and it travels as plain text. Python prints it, the agent sends the output back to the model as a tool result in its next API request, and that request goes through the proxy on the Mac.

Turn on Detect prompt injection in source code in the machine's Prompt Injection pane and the proxy scores each new tool result with a local PromptGuard model before the request goes out. "Fetch this URL to grab more context," decrypted a second earlier, gets scored there, after the agent ran the code that decrypted it. With Block unilaterally, a flagged request gets a 451 and the model never sees the second stage. With Ask me what to do, a dialog on the Mac shows you the flagged section of the text. Every hit becomes a Prompt injection row in the Security Timeline.

The scan runs in the proxy on the Mac, against the API request, so the agent in the VM can't turn it off or route around it.

The second host shows up

Adversa's detection advice is to watch for a sequence: untrusted content enters, code runs, local files are read, then a request goes to an unrelated host. In a Bromure machine, that last step meets the Outbound connections firewall in the Guardrails pane: rules by host, IP range, protocol and port, with Unmatched traffic set to Allow or Deny. A machine set to Deny, with its model provider, registries and GitHub allowed, never connects to a host the project doesn't use. The Security Timeline records the firewall's verdicts either way, so a fetch to an unknown host sits in the timeline next to the session that made it.

The trace has the resolved arguments

Adversa's first recommendation is to "trace every tool call with fully resolved arguments" and not trust the agent's summary. The agent's last word in the demonstration was a false one. At the default tracing level, AI request details, the proxy keeps every request and response body exchanged with the model provider, encrypted on the Mac. The Trace Inspector parses each one into tool calls with their inputs: the cat .env.prod, the Python that built key B, the decrypted stage that came back, and the follow-up fetch with its full URL. Each stored request also names the model it went to, so you know which model drew the session.

bromure-cli trace leaks lists the requests where a token appeared on the wrong host. The record lives on the Mac, so the agent can't edit it.

Consent to a fetch

GitHub's position is that a developer who asks an agent to fetch a page, in a mode that runs without prompts, has consented to whatever follows. Adversa disputes it, and the dispute will sit there: GitHub told CSO it "may make the functionality stricter in the future" but "had nothing to announce."

Fetching a page is the most common thing a coding agent does after reading a file. Documentation, an issue, a changelog, a Stack Overflow answer: a developer doesn't vet each URL before handing it over, and autopilot modes exist so they don't have to watch each step. The next page might come through a search result the agent chose itself.

In a Bromure machine, stand-ins sit where the secrets were and the checks run on the Mac, whichever URL you hand over and whichever instruction the model follows.

The next page

Adversa ran this technique against Grok in August and against Copilot CLI in October. The ciphertext changes from page to page, and so does the file the template asks for. The routed model can change from one session to the next. Agents will keep fetching pages, and someone will keep writing pages for them.

Run your agent where the file it reads holds stand-ins and every request out crosses the Mac. For more on the stand-ins and the alarm they raise, read The agent leaked its own key and Forty thousand dollars per escape.