GitHub Copilot reportedly allowed free LLM tokens by spoofing agent-initiated requests

The core issue stems from GitHub Copilot’s billing logic relying on a client-controlled header to determine whether to charge for LLM requests. The `X-initiator` header, set to either `user` or `agent`, was used to distinguish between requests triggered by the user and those initiated by Copilot’s internal processes. This design choice created a classic client-trust vulnerability, where the client could manipulate billing outcomes by altering the header value.

The researcher’s proof-of-concept used `mitmproxy` to intercept and modify requests, changing the `X-initiator` header from `user` to `agent` for `/v1/messages` endpoints. This simple modification bypassed billing entirely, as Copilot’s backend did not validate the header’s authenticity. While the vulnerability did not restrict model access, responses to spoofed requests were truncated, suggesting a backend-enforced `max_new_tokens` limit for agent-initiated calls.

For engineers, this incident highlights the risks of client-side billing decisions in API design. Systems that rely on untrusted client input for financial transactions are inherently vulnerable to abuse. The fix will likely require Copilot to move billing validation to the server side, where request origins can be verified independently of client-provided headers. Until then, users should assume that token usage may not align with billing statements.

The broader implication is a cautionary tale for AI-powered tools that abstract LLM interactions. When billing is tied to internal request categorization rather than actual usage, edge cases like this emerge. Teams integrating Copilot or similar services should audit their token consumption patterns and verify that all LLM calls are accounted for in billing reports, regardless of their origin.