Are we sure this actually is originating from MS Copilot itself? Technically I believe it would be possible to smuggle ads into PRs using prompt injection too.

Yes https://github.com/search?q=%22%E2%9A%A1+Quickly+spin+up+cop...