It is one thing to put by accident your API key on your public Github repository.
And it's another (bigger) issue for Copilot to pick up that API key and put it in someone else's project.
And it's another (bigger) issue for Copilot to pick up that API key and put it in someone else's project.
Copilot is an issue, but I would assume malicious agents are already doing copilot-like things, just not in the open.