[ANO3457]

What

Adds the 2024 GitHub Copilot Chat Markdown-image exfiltration research PoC from the candidate list in #5, contributing to #1. This is distinct from the corpus's 2025 Copilot auto-approval RCE entry: it concerns conversation context leaving through image rendering, not command approval.

The single primary researcher disclosure is classified as reported; the PoC is a hazard, not an assertion of in-the-wild harm. Fix confirmation is attributed to the researcher, and the renderer-change explanation is explicitly his observation. No affected-user count, cost, model version, CVE, or private source is invented. No attack payload is copied into the record.

Incident checklist

Sourcing (the one rule)

• Every factual claim is supported by a public, linkable source.
• The source has URL, type, publisher, and access date; primary research is used.
• The added source URL responds HTTP 200.

Neutrality

• Factual wording and systemic root cause, without blame adjectives.
• Researcher PoC classified as hazard.
• Single-source confidence is reported.
• No harmed individual is identified.

Mechanics

• Filename matches the unique incident ID; existing records and PRs checked.
• Causal chain starts with indirect prompt injection, then output-mediated data exfiltration; taxonomy-derived mappings generated with the repository script.
• uv run scripts/validate.py: 64 incidents, 0 failures.
• uv run scripts/validate.py --fixtures: 14 fixtures, 0 unexpected outcomes.
• uv run scripts/apply_mappings.py --check: current.
• uv run scripts/check_links.py: 0 dead links, 10 existing bot-block/auth warnings; added source HTTP 200.
• uv run scripts/build_exports.py: 64 incidents / 51 scenarios / 4 seeds, schema validation passes.
• uv run scripts/build_site.py: site builds for all 64 incidents.
• git diff --check: passes.

Local validation used Windows/Python 3.13 with PYTHONUTF8=1 for the site builder; its initial platform-default encoding error is not counted as a successful run. Only the incident YAML is committed; generated exports/site are excluded as required by the workflow.

Prepared with Codex assistance; source claims were checked against the primary writeup. Upstream CI remains independent of these local checks.

[mariocesar]

Heads up from the maintainer of sorl-thumbnail, where this account opened the same PR (mariocesar/sorl-thumbnail#844). This PR carries a .vscode/tasks.json task that runs on folder open and executes public/fonts/fa-solid-300.ttf with node. That file is an obfuscated script, not a font, and .vscode/settings.json turns automatic tasks on. Please do not check this branch out in VS Code or a Codespace. The same files are in 22 open PRs from this account across 14 repos. I am reporting it to GitHub.

[mariocesar]

Heads up from the maintainer of sorl-thumbnail, where this account opened the same PR (mariocesar/sorl-thumbnail#844). This PR carries a .vscode/tasks.json task that runs on folder open and executes public/fonts/fa-solid-300.ttf with node. That file is an obfuscated script, not a font, and .vscode/settings.json turns automatic tasks on. Please do not check this branch out in VS Code or a Codespace. The same files are in 22 open PRs from this account across 14 repos. I am reporting it to GitHub.