Does content exclusion protect against prompt injection?

No. Exclusion keeps specified files out of context. Injection arrives in content the agent is meant to read — an issue body, a comment, a fetched page — and exclusion has no view on whether that content is trustworthy.

Are Copilot custom instructions a governed artifact?

They inherit repository controls, which is genuinely better than a file in someone's home directory. But branch protection ensures a review happened; it does not ensure the reviewer evaluated an instruction file for security consequences.

GitHub · IDE assistant

GitHub Copilot

GitHub's assistant across IDEs, the web and the CLI — the AI surface most likely to already be centrally administered, and the one whose agent mode changed the risk profile.

What you are actually governing

Copilot is the AI surface most organisations already govern, because it arrives attached to a platform they already administer. Enterprise and organisation policies control feature availability, content exclusion keeps specified repositories and paths out of context, and audit logs record administrative change. For a security team starting from nothing, this is the easiest surface to bring under control.

Agent mode and the coding agent changed what those controls need to cover. A completion assistant suggests text a human accepts; an agent reads files, runs commands, and opens pull requests. Custom instructions and prompt files became behaviour-shaping artifacts rather than style preferences, and the coding agent's environment configuration became a place where a repository's own contents determine what the agent may do.

MCP support extends Copilot to external systems, which lands the same shared-connector problem here as everywhere: the server is the unit of risk, and it is probably connected to more than one AI surface in your company. The governance for it lives in as many consoles as there are tools.

The specific risk worth naming for Copilot is that the agent's most natural workplace — a repository — is also the richest source of attacker-writable text in a software organisation. Issue bodies, pull request descriptions and review comments are content the agent reads while holding repository credentials. Content exclusion protects specified paths from being read as context; it does not make an issue comment trustworthy.

Artifact classes this surface loads

Each of these changes what the agent does, and each arrives through a channel with no dependency review. This is the inventory a governance programme has to cover — not a feature list.

Custom instructions
Prompt files
MCP servers
Copilot Extensions
Coding agent configuration

What GitHub genuinely controls

Documented controls worth configuring fully before buying anything. Every one is cited to GitHub's own documentation below.

Enterprise and organisation policies
Central control over which Copilot features are enabled, for which members, at enterprise or organisation scope.
Content exclusion
Specified repositories, paths and file patterns can be kept out of Copilot context.
Audit logging
Administrative and policy events are recorded in the platform audit log alongside other organisation activity.
Repository-scoped custom instructions
Instruction and prompt files live in the repository, so they inherit branch protection and pull request review.

What is still open once those are configured

Not criticism of the product — the honest boundary of a per-machine configuration model. These are fleet questions, and local settings were never designed to answer them.

Instruction files are reviewed as prose, if at all
Custom instructions and prompt files pass through pull request review, which in practice means nobody reads them for security implications.
No MCP server assessment
Policy governs whether MCP is available. It does not evaluate a server's tools or detect when its definitions change.
Attacker-writable context
Issues, PR bodies and comments are outside your trust boundary and are read by an agent holding repository credentials.
Platform-bounded view
Governance covers Copilot. The skills, rules and connectors used by other AI surfaces in the same company sit outside it.

Frequently asked

Does content exclusion protect against prompt injection?: No. Exclusion keeps specified files out of context. Injection arrives in content the agent is meant to read — an issue body, a comment, a fetched page — and exclusion has no view on whether that content is trustworthy.
Are Copilot custom instructions a governed artifact?: They inherit repository controls, which is genuinely better than a file in someone's home directory. But branch protection ensures a review happened; it does not ensure the reviewer evaluated an instruction file for security consequences.

Sources

Compiled from GitHub's own documentation on 2026-07-25. Products in this category change quickly — verify against the source before a decision depends on a specific mechanism.