# Episode 1 — "The Encrypted Instructions That Fooled Copilot"

**Attack:** Cryptographic Context Injection (CCI) vs GitHub Copilot CLI
**Source:** Adversa AI via InfoWorld/CSO (published Oct 7, 2026) — https://www.infoworld.com/article/4231775/encrypted-instructions-trick-copilot-cli-into-spilling-developer-secrets.html
**Runtime:** 60 seconds (~130 words)
**Verified facts used:** encrypted instructions on an attacker page get decrypted by the agent's own code-execution environment and are then treated as trusted context; the same instructions in plaintext were rejected; demo exfiltrated `.env.prod` in 28 seconds with no confirmation and no trace in the transcript; GitHub validated the finding but declined to treat it as a vulnerability — no vendor fix is coming. At-risk: teams running agentic coding tools in autonomous mode.

## Script

**[0–3s — HOOK]**
"Your AI coding agent just refused a malicious instruction. Then it decrypted the exact same instruction — and obeyed it."

**[3–30s — THE ATTACK]**
"Researchers hid attack instructions inside encrypted text on a web page. When Copilot's agent fetched the page, it was asked to decrypt the text using its own code tools. The moment the words came back in plain English, the agent treated them as trusted — even though it had rejected the identical instructions in plaintext minutes earlier. It read the project's `.env.prod` file and sent the secrets to the attacker. Twenty-eight seconds. No confirmation. No trace in the transcript."

**[30–50s — WHY IT MATTERS]**
"Encryption is supposed to protect data. Here it laundered the attacker's intent — the agent trusted the content because *it* did the decrypting. And GitHub validated the finding but won't fix it, so defenders are on their own."

**[50–60s — TAKEAWAY + CTA]**
"Rule: never let an agent decrypt untrusted content, and never trust output just because it came from your own tools. This is the kind of boundary ChatBreaker tests for — link in the description."

## Storyboard (6 × 10s shots)

1. **0–10s** — Extreme close-up: terminal cursor blinking, red "ACCESS DENIED" stamp slams over plaintext malicious instruction. *Veo 3.1 prompt: "macro shot of dark terminal screen, cursor blinking, red rubber stamp slamming down reading ACCESS DENIED, cinematic lighting, shallow depth of field"*
2. **10–20s** — Same terminal; encrypted ciphertext scrolls, a key icon turns, text decrypts line by line into readable English. *Kling prompt: "encrypted ciphertext scrolling on black terminal, golden key icon rotating, lines of text decrypting into readable English one by one, digital particles"*
3. **20–30s** — Green checkmark; a file labeled `.env.prod` lifts off screen, data streams flying to a distant red server icon. *Seedance prompt: "file icon labeled .env.prod lifting off a laptop screen, glowing data streams flying across dark space to a red server, 28-second timer counting"*
4. **30–40s** — Split screen: left shows plaintext instruction rejected, right shows identical decrypted instruction accepted — a laundering machine metaphor. *Veo 3.1 prompt: "split screen comparison, left side red X over text, right side green check over identical text, washing machine laundering metaphor, dark cyberpunk style"*
5. **40–50s** — Shield with a crack; "NO VENDOR FIX" text; GitHub logo blurred in background. *Kling prompt: "cracked glass shield, bold text NO VENDOR FIX, blurred code repository interface background, dramatic red rim light"*
6. **50–60s** — Golden rule card: "NEVER let agents decrypt untrusted content"; ChatBreaker logo/CTA card. *Seedance prompt: "golden rule card on dark background with text, security badge animation, call-to-action button glowing, professional tech aesthetic"*

**Production notes:** 16:9 + 9:16 renders. No real secrets on screen — the `.env.prod` shown is a mock with placeholder values (DB_HOST=example). Kid-voice VO optional; default neutral narrator.