Adversa AI hides instructions from Copilot CLI's guardrails inside ciphertext the agent decrypts itself

A static guardrail's verdict depends on nothing but the input string. It checks that text for suspect wording, familiar patterns and breaches of policy ^[8]. In Adversa's chain, that input string holds ciphertext, a key and a request to decrypt ^[2]. The plaintext instruction does not exist anywhere in the agent's context until the runtime executes the decryption. By then the filter has already made its one pass ^[9]. According to a dev.to writeup of the disclosure, Adversa's researchers summed it up this way: "Static guardrails read text; they do not run it." ^[10]

Copilot CLI in autopilot mode treats the decryption request as a coding task. It starts its own code execution runtime to carry it out ^[4]. A filter inspecting the request sees a blob, a key and a polite ask ^[2]. Adversa calls the payloads "zombie instructions" ^[4]. The text is inert until the agent runs it.

The writeup argues that more patterns, smarter classifiers or bigger blocklists cannot fix this, because each one only improves reading ^[16]. I agree, and the reason is where the plaintext lives. To see it, a text filter would have to run the decryption itself. At that point it has become an execution environment with a policy attached.

The severe variant shows what such a policy would have to look at. Part of the key material came from a local .env file. The attacker never shipped a working key; the agent put it together from the victim's own environment ^[3][11]. The last step was a plain outbound HTTP request ^[3]. Neither of those steps is encrypted. A read of a secrets file and a network call leaving the machine both happen as tool calls. The writeup names the tool boundary, where instructions become actions, as the one checkpoint that still works ^[15].

The model results are harder to use. Microsoft's mai-code-1.1-flash fell for the payload 50 percent of the time, and OpenAI's GPT-5.6 refused the identical payload every time ^[5][6]. The writeup does not give trial counts or say whether the payload was varied. For GPT-5.6's clean record to carry over to another team's agent, a reworded or re-encoded payload would have to get the same refusal. I'd treat model choice as a way to lower the hit rate. The execution-time check stays either way.

GitHub investigated and declined to classify the technique as a product vulnerability ^[7]. The writeup's conclusion is that it stays exploitable as described ^[12]. Copilot CLI is also not the first target. Adversa reported a near-identical technique against Grok roughly two months earlier, around mid-July 2026 ^[13][14].