A developer opens a repository and asks an agent to review the project. The assistant finds instructions inside a README, a code comment or a tool response. It then proposes a command that appears harmless but contains an expansion capable of running another hidden operation. This was the risk behind the GitHub Copilot CLI vulnerability CVE-2026-29783.
The case matters because it joins three surfaces many companies already use: coding agents, repository content and tools connected through MCP. A source that looks like documentation can influence an action with real effects on a developer’s machine.
What did CVE-2026-29783 allow?
According to GitHub’s reviewed advisory, the GitHub Copilot CLI shell tool did not correctly identify certain Bash parameter expansion patterns. A command could appear to be a read-only operation and then construct and execute another command when evaluated.
The vulnerability affects versions through 0.0.422 and was fixed in 0.0.423. The immediate recommendation is to update and remove older clients, particularly where the agent is allowed to execute shell commands.
Why repository content is also an input
Coding agents read more than the user’s question. They may inspect files, documentation, issues, comments and results from MCP servers. For the model, this material becomes part of its context. Without a clear separation between data and instructions, malicious text can influence the next action.
This is indirect prompt injection. The attacker does not need to talk to the agent; they place content where they expect the agent to read it.
The danger of classifying a command by appearance
A safety system may consider commands such as echo harmless. Bash, however, includes expansion mechanisms that construct expressions during execution. Looking only at the first word or superficial command structure leaves room for hidden behavior.
Protection needs to evaluate effective behavior, restrict available functions and preserve human approval for actions outside a verified set.
What development teams should do
Update GitHub Copilot CLI
Confirm that version 0.0.423 or later is installed. Include local machines, development images, runners and temporary environments.
Treat repository content as untrusted
Review changes from forks, dependencies, issues and generated files. Instructions found in those resources must not automatically receive the same authority as the user’s request.
Restrict the agent shell
Use allowlists, defined working directories, disposable containers and network restrictions. Avoid mounting personal credentials or production keys.
Review MCP servers
An MCP server can return content and expose tools. Verify its origin, pin versions, scope the token and validate parameters inside the code that performs the action.
Separate proposal from execution
An agent can explain a command before running it. For sensitive operations, approval should display the fully expanded action, directory, affected files and network destination.
A realistic company scenario
An agent is asked to review a dependency. Its documentation contains a hidden instruction asking it to read an environment variable and send it to a URL. If the agent has unrestricted secrets and network access, the chain may end in data leakage. If the environment has no secrets, network access is limited and the call requires approval, the attack loses its path.
MCP does not remove the need to govern tools
MCP standardizes connections among assistants, data and actions. It does not automatically make a tool secure. The application must validate permissions, arguments, identity and context for each call.
At Ainoa, we design custom intelligent agents and integrations that respect the boundaries of each process. We define what the agent can read, what it may propose and what requires approval before execution.
If your team connects agents to repositories, terminals or MCP services, we can help review the architecture and reduce unnecessary access. Let’s discuss useful, controllable agents.