At work, just noticed that in one of our private repo's contributors page, some strange user was being displayed. Knowing that it could be simply due to some e-mail appearing in the author's commit or within the very own commit message, I just went around looking for anything suspicious in the timeframe from where the commit mentioning this strange user apparently happened.

After some digging, I tracked down to some commit with the following snippet at the end "Co-authored-by: Copilot <copilot@github.com>". Well, it could be it, but would be very strange if that was the case. So, in my personal account, I created a private, separate repo and tested. A simple commit, arbitrary title, but with a commit message having the exact same string: "Co-authored-by: Copilot <copilot@github.com>".

Again, for this test, I didn't use Copilot to generate the commit or the actual "change", but rather just added this string to the message. The commit resolves that e-mail to the exact same strange user I saw in the collaborators list of the company's repo. It's resolving to this guy: github.com/00sadik-lab.

Can anyone confirm the same behaviour?

Github's email integration with security is not great. I found some bugs with management of repo's and email security and I would not be surprised if this is a bug that they have.

Please don't use HN to test your exploit