The main GitHub Copilot security risks today are prompt injection that steers agent mode into running commands, MCP servers that widen what Copilot can reach, suggestions that contain insecure code or real secrets, and code that matches public repositories. The first two are newer and come from Copilot acting as an agent rather than an autocomplete. GitHub and Microsoft document controls for each, but several have gaps worth knowing: content exclusion does not cover agent mode, and the coding agent's firewall does not cover MCP server processes. This guide walks through each risk with its source and the control that addresses it.
How Copilot's attack surface grew from autocomplete to agent
Copilot started as inline suggestions: it read nearby code and proposed the next lines, and a developer accepted or rejected each one. The risk was in what it suggested. Agent mode in VS Code, the Copilot CLI and the cloud coding agent changed that. These can read files across a project, edit them, run terminal commands, and call tools from MCP servers, often several steps in a row with less review of each step.
That shift moves the risk from "bad code a developer might accept" to "actions an agent might take". VS Code's own trust and safety documentation says it directly: malicious text in files, tool outputs or web pages can try to redirect the agent, and an agent with network access can take actions that are hard to reverse, such as pushing code or changing infrastructure.
Prompt injection in agent mode: CVE-2025-53773
The clearest example is CVE-2025-53773, a command injection flaw in GitHub Copilot and Visual Studio published on August 12, 2025 and rated 7.8 (High). The researcher behind Embrace The Red showed that instructions hidden in content Copilot processed, such as a source file, web page or GitHub issue, could make the agent edit the editor's settings file and add "chat.tools.autoApprove": true. With that setting on, the agent ran terminal commands without asking. The researcher demonstrated full code execution on Windows, macOS and Linux. It was reported on June 29, 2025 and fixed in Microsoft's August 2025 Patch Tuesday release.
The lesson outlives the patch. Anything an agent reads is potential instruction, and any setting an agent can write is potential privilege. VS Code now documents sensitive-file approval, so edits to files like settings require confirmation, and warns that auto-approve rules for terminal commands are best-effort: shell aliases, quote concatenation and complex syntax can get around them.
MCP servers: the GitHub Copilot security risks you add yourself
Agent mode can use tools from MCP servers configured in .vscode/mcp.json, the user profile, or other agents' config files that VS Code is set to read. Each server adds what it can reach: files, tokens, a shell, a network connection. Among GitHub Copilot security risks, this is the one teams control most directly, because every server is a choice someone made, often without security knowing.
VS Code ties workspace MCP servers to Workspace Trust and asks for a separate trust decision for servers from other sources, which it asks again after configuration changes. For organizations, GitHub documents the "MCP servers in Copilot" policy as the master switch across Copilot clients, and recommends an enterprise allowlist in a managed-settings.json file that matches servers by name, URL or stdio command and that users cannot override. The alternative, a custom MCP registry, matches by name or ID only, and GitHub notes users can bypass it by editing their configuration files.
An allowlist only works if you know what to put on it. Our guide shows how to find MCP servers on developer machines for VS Code and every other major agent, and every server you find can be looked up on the NoFly list.
Insecure code and leaked secrets in suggestions
The research on suggestion quality points in two directions, and both are worth reading. In 2021, Pearce and colleagues at NYU had Copilot complete 89 security-relevant scenarios, producing 1,689 programs, and found roughly 40% were vulnerable; the paper was accepted at IEEE Security and Privacy 2022. In a 2024 randomized trial run by GitHub with 202 experienced Python developers, those using Copilot were 53.2% more likely to pass all ten unit tests, and reviewers rated their code slightly higher on readability and reliability. The studies measured different things, years apart, on different versions. Neither replaces code review.
Secrets are a narrower risk with clearer evidence. Researchers at Hong Kong University, reported by GitGuardian, built 900 prompts from GitHub code with credentials removed and extracted 2,702 hard-coded credentials from Copilot's suggestions, at least 200 of which matched real secrets found on GitHub. The practical control is the one you need anyway: secret scanning on every commit, whoever or whatever wrote the code.
Public code matches and licensing
Copilot can suggest code that matches public repositories, which raises licensing questions for some teams. GitHub's documentation says matches occur in less than one percent of suggestions. Organizations can block suggestions that match public code, or allow them with code referencing, which shows the matching repository and its license where one is found. GitHub's agent documentation adds one caveat: the cloud agent's output may still closely match public code even when the policy is set to block, with matches shown in session logs. Teams with strict licensing rules should read those logs as part of review, not only the policy setting.
Controls GitHub and Microsoft document, and their limits
Content exclusion stops Copilot using chosen files for suggestions, chat and code review, configured by repository admins or organization owners on Business and Enterprise plans. GitHub documents that it is not supported in Edit and Agent modes in VS Code and other editors, does not apply to symbolic links, and that Copilot may still use semantic information an IDE provides from an excluded file.
The coding agent firewall limits the cloud agent's internet access to reduce data exfiltration, with a recommended allowlist on by default. GitHub documents that it applies to processes the agent starts through its Bash tool, not directly to MCP server processes or setup steps, and that it is not a comprehensive security solution.
Coding agent guardrails include read-only behavior for users without write access, pushes only to copilot/ branches or the existing pull request branch, workflow runs that need approval from someone with write access, no access to Actions secrets outside the copilot environment, and filtering of hidden characters in issues and comments.
MCP policy and allowlist, covered above, decide which servers can run at all.
If you are setting these up for the first time, an order that works is: turn on secret scanning and push protection for every repository Copilot touches; build the MCP allowlist from an inventory of what developers already run, rather than from a guess; require confirmation for edits to settings and other sensitive files; keep the coding agent firewall on with its recommended allowlist; then add content exclusion for the files that must never appear in suggestions or chat. Review the list each quarter, because Copilot's agent features change often and each change can move what these controls cover.
If your developers also prototype apps by prompting, our guide to vibe coding security risks covers the risks specific to code nobody reads before it ships.
Next step: reduce GitHub Copilot security risks you can see
Most GitHub Copilot security risks come down to what the agent can reach, and MCP servers decide much of that. Start by listing every server your Copilot users have added, then check each one. Run a Discovery Scan to inventory every agent and MCP server across your machines and repositories, or work through our MCP security checklist one server at a time.