One Click in VS Code Was Enough to Hand Over Your GitHub Token

Here's the kind of bug that makes you stare at your IDE for a second.

Researcher Ammar Askar disclosed a one-click attack against the browser-hosted version of Microsoft's Visual Studio Code that could quietly hand over a victim's GitHub OAuth token. Not a scoped, read-only token. The real one. Read and write, public and private repos.

The staging ground is github.dev, the in-browser VS Code instance you get by pressing . on any GitHub repo. It runs the editor as a web app, authenticated against your GitHub session. Convenient. Also, as it turns out, a tidy little OAuth surface.

Askar's attack chain abuses the way github.dev acquires its token. A malicious link can coax the flow into completing against an attacker-controlled context, and the resulting token — the same one your editor uses to push commits — ends up exfiltrated. From the victim's point of view, they clicked something. That was the whole interaction.

If this sounds familiar, it should. Strip away the AI-adjacent IDE branding and you're looking at a textbook OAuth redirect/abuse pattern, the same family of bugs that has haunted SSO integrations for a decade. The novelty is the delivery vehicle, not the primitive.

Why it matters for the AI-tooling crowd: github.dev is increasingly the launchpad for Copilot Chat, Codespaces handoffs, and a growing menagerie of agentic extensions that expect a live GitHub token in the browser context. A stolen token there isn't just a code-leak problem. It's repo-write access, which means an attacker can plant backdoors in build scripts, poison training data sitting in a repo, or quietly modify a .github/workflows/ file and ride your CI runner into wherever it has secrets.

The blast radius scales with how much of your developer life lives behind that single OAuth grant. For most people who clicked "Authorize" once in 2021 and forgot about it, the answer is: a lot.

GitHub was notified and the underlying issue has been addressed on the github.dev side. Askar's writeup walks through the token-acquisition flow and where it went sideways. There's no public indication the bug was exploited in the wild before disclosure, which is the small mercy here.

A few things worth doing anyway. Audit your authorized OAuth apps and personal access tokens at github.com/settings/applications and revoke anything you don't recognize or haven't used in a year. If you live in github.dev, treat unsolicited links that bounce you into it the way you'd treat a sketchy docusign.net lookalike — with suspicion, and a fresh tab you opened yourself.

The interesting question isn't whether this specific bug gets patched. It's how many other "just press dot" conveniences are sitting on the same kind of OAuth plumbing, waiting for someone curious enough to pull on the thread.