VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN
Researcher ahacker1, using the Hacktron AI tooling, disclosed a bypass of earlier fixes for prompt-injection-to-RCE in VS Code Copilot Chat agent mode. A TOCTOU flaw in the applyPatchTool component lets a crafted prompt write files outside the workspace without user confirmation. The attack can be triggered by pasting a prompt into Copilo…