GitHub Copilot Traffic Analysis via MITM Proxy Exposes Prompt Context Handling and Local SQLite Session Storage
A security researcher conducted an in-depth analysis of GitHub Copilot by routing all network traffic from Visual Studio Code through an mitmproxy instance configured as a man-in-the-middle proxy.
The study began with the observation that Copilot rapidly consumes monthly request quotas, prompting an investigation into its internal communication patterns. Because Visual Studio Code and Copilot are built on Electron, the researcher first mapped the application’s network architecture, distinguishing between Chromium-based renderer processes and Node.js HTTP requests.
Proxy Setup and Traffic Interception
After installing mitmproxy via Homebrew and configuring VS Code proxy settings (Http Proxy, Strict SSL disabled, Proxy Support set to override), the researcher launched mitmweb to capture live requests. Additional steps included restarting the Extension Host process to ensure fresh connections were routed through the proxy.
Traffic analysis showed multiple request categories even before any code was typed: authentication and session management via OAuth, configuration and policy retrieval, MCP registry access, repository and session context, model discovery, and recent repository listings.
Model Intent Routing and Prompt Construction
In Auto mode, Copilot sends each prompt to the /models/session/intent endpoint for classification into categories such as code-gen, debugging, or tool-use. The resulting classification determines which model handles the request.
Inline suggestion requests were observed to include the current file path and content from recently edited files. When a fake secret was placed in a .env file, the secret appeared in prompts generated while editing an unrelated pyproject.toml file, demonstrating that context collection is not limited to the file where suggestions are enabled.
Local Session History and Chronicle Tool
Many requests referenced a tool named session_store_sql that can execute read-only SQLite queries against a local database called session-store.db. The database stores session summaries, user prompts, LLM responses, repositories, branches, and checkpoints.
When the researcher asked Copilot what work had been done the previous week, the model first attempted an invalid query, performed schema introspection, and then successfully retrieved records from the local store using the Copilot Chronicle skill.
The findings illustrate how GitHub Copilot maintains persistent local state and incorporates broad context into prompts sent to remote models.
Related articles
OpenAI GPT-6 Astra Reaches 100% Exploit Generation Accuracy on ExploitBench
OpenAI has unveiled GPT-6 Astra, its latest model that demonstrates unprecedented capability in generating working exploits from known vulnerabilities. The model scored a perfect 100% on ExploitBench, significantly outperforming the previous GPT-5.6 Sol at 78.5%. In tests involving recently disclosed vulnerabilities, Astra achieved arbitrary code execution in 39% of cases compared to 11.5% for its predecessor and discovered two previously unknown zero-day flaws. Due to these capabilities, OpenAI has restricted the public release to safe code analysis and patch development only, blocking requests for proof-of-concept exploits. Expanded access for vulnerability research and malware analysis will be provided through the Daybreak program to selected defenders, while the company adds stronger jailbreak protections and activity monitoring.
How to Interact with AI Models Without Exposing Sensitive Data
The article provides practical guidance on minimizing data leakage risks when using popular AI chatbots such as ChatGPT, Gemini, Claude and GigaChat. It explains that conversations are routinely scanned by automated filters and may be reviewed by human moderators or shared with law enforcement upon request. Key recommendations include disabling model training on user data, replacing sensitive values with placeholders, regularly deleting chat histories and verifying downloaded models for malicious injections. The guide also demonstrates local deployment using Ollama and secure API integration through the ChatBox client with Cloud.ru’s Evolution Foundation Models service. Local execution in Docker containers is presented as the most private option, although it requires significant computational resources. The author stresses that even after disabling training, data may still reach moderators and that users remain responsible for their own information.
Raft Develops Multilabel Guardrail Classifier Detecting 15 Risk Categories with 3x Speed and Cost Gains
Raft has released details on a custom multilabel guardrail classifier designed to scan both incoming prompts and model outputs for 15 distinct risk categories in real time. The system handles Russian and English text while maintaining independent thresholds for each category to balance false positives against critical misses. By switching from a PyTorch baseline to TensorRT inference on NVIDIA RTX 3090 hardware, the team achieved a 2.95x reduction in single-request latency and lowered inference cost to $0.062 per million requests. The architecture uses per-category expert query tokens plus a lightweight interaction transformer to capture correlations such as those between armament and violent content. Training relied on asymmetric loss functions and post-epoch per-class threshold tuning rather than standard binary cross-entropy. Benchmarking against nine open guardrail and toxicity models showed superior macro-F1 on rare but high-impact categories while remaining an order of magnitude cheaper than external LLM judges.
Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
At the Fourth Cyberspace Security Forum in Tianjin, 360 founder Zhou Hongyi stated that vulnerability mining is shifting from artisanal workshops to automated production lines, compressing discovery cycles from months or years down to hours. AI tools such as Mythos are standardizing and automating the process, enabling attackers to replicate elite hacker expertise at scale through distilled models and agent swarms. 360's own Tulongfeng platform has already discovered over 10,000 vulnerabilities since its June release, including long-hidden high-risk flaws in Windows, Office, OpenClaw, Flowise, and Codex. The emergence of multi-agent systems introduces new attack surfaces because compromised agents can autonomously collaborate and move laterally faster than human operators. Zhou described this as the "second one-way transparency," where offensive tradecraft becomes copy-pasteable via prompts and toolchains. Defenders are advised to adopt "model-versus-model" strategies, automate vulnerability intelligence workflows with SOAR, enforce strict agent permission audits, and integrate AI into their own code review and detection engineering processes.