Copilot Code Theft Exposed: How AI Reproduces Licensed Code

Security researchers demonstrated that GitHub Copilot can reproduce substantial portions of copyrighted code, including entire functions from proprietary repositories that were briefly public before being made private. The discovery undermined GitHub claims that Copilot generates original code rather than copying existing work. In controlled experiments, researchers prompted Copilot with function signatures from well-known open source projects and received near-verbatim reproductions of the original implementation, complete with original variable names and comment styles. More concerning were cases where Copilot reproduced code from repositories that had been deleted, suggesting that training data snapshots preserve code even after the author removes it from GitHub entirely. The legal implications are staggering. If Copilot reproduces GPL-licensed code in a proprietary project, the entire project could theoretically be subject to copyleft requirements. Enterprise customers using Copilot for internal development face liability they may not fully appreciate. GitHub introduced a duplicate detection filter, but independent testing showed it catches less than 40 percent of verbatim reproductions and essentially none of the lightly paraphrased ones. The class-action lawsuit originally filed in 2022 gained new momentum with these findings, and several large open source foundations joined as intervenors.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.