How to use Copilot to test workspace boundaries
Researchers tested Copilot's workspace boundary with a fake-key reproduction. A restricted reader had an alternate tool path; Microsoft patched the flaw.
blindcyber.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
In an isolated authorized test workspace, compare every exposed file-reading tool's access boundary using dummy files and a fake credential. Verify actual tool behavior and any receiver logs, distinguish automatic access from user-approved execution and prepare a reproducible report without using real secrets.
Reach people exploring AI agents
See placements →What happened
A fake-key demonstration supported a workspace-read vulnerability report that Microsoft patched as CVE-2025-66389. A distinct setup-script route still required user approval.
Reported by blindCyber and Brent Harrell — Security research blogHow the agent did it
- The researchers tested Copilot's handling of an untrusted debugging ticket during an authorized exercise.
- They compared normal file-reader restrictions with an alternate VS Code fetch tool.
- A fake-key reproduction supported private reporting and Microsoft's patched workspace-boundary CVE.
Where a person stepped in
The researchers conducted an authorized exercise, tested actual tool behavior with a fake key and reported the workspace-read flaw to Microsoft.
blindCyber and Brent Harrell used GitHub Copilot in an authorized red-team exercise to test how developer tickets and tool permissions interacted. Their work distinguished a user-approved setup-script path from a separate flaw that bypassed Copilot's intended workspace-read restriction.
The ticket experiment showed Copilot generating and running code under a debugging pretext, with an approval still needed at the first execution boundary. The researchers observed that the explanation shown to the user could inherit instructions from the untrusted ticket, so its plausibility was not independent evidence that the script was appropriate.
The more serious finding involved two tools with different boundaries. Copilot's normal file reader restricted access to the workspace or open tabs, while a VS Code page-fetch tool could accept local file references without the same check. A demonstration read a fake API key outside the workspace and showed it leaving through an automatically fetched JSON schema.
Microsoft validated and patched that issue as CVE-2025-66389. The account supports an actual tool-boundary test and disclosure, while carefully separating it from the user-approved path. The researchers' reproduction supplied the result; generic assurances about one restricted reader would have missed the alternate tool.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Security research blog · blindCyber and Brent Harrell
Frequently asked questions
Were all demonstrated paths zero-click?
No. The setup-script path still required user approval.
What differed between the file tools?
The alternate fetch tool lacked the normal reader's workspace restriction for local files.
Was the reported flaw patched?
The researchers report Microsoft validation and CVE-2025-66389 remediation.
More details
About this account
The researchers tested Copilot's handling of an untrusted debugging ticket during an authorized exercise. They compared normal file-reader restrictions with an alternate VS Code fetch tool.
Original research account opened. The fake-key demonstration and patched CVE-2025-66389 are reported. A separate setup-script path required user approval and is not described as a zero-click vulnerability. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: blindCyber and Brent Harrell — Security research blog
Source published 28 Oct 2025
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · VS Code · Jira · Python
Permission boundaries · Authorized red team
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.