将 GitHub Copilot 置于中间人（MitM）代理之后后，我学到了什么

Core Highlights

A developer used mitmproxy to perform a man-in-the-middle interception of GitHub Copilot's traffic inside VS Code, reverse-engineering its network requests, authentication method, and backend scheduling logic. The most valuable insight of the article is that mainstream AI coding assistants are mostly built on Electron with highly similar network stacks, so the probing methods applied to Copilot can be transferred to other comparable products. That observation turns a single experiment into a reusable technique for anyone curious about what their AI tool actually sends over the wire. It is a reminder that convenience often hides network behavior worth inspecting before trusting a tool with proprietary code that a leak could expose to a competitor.

It also doubles as a timely reminder that 'local' AI tooling still phones home through channels most users rarely inspect or even suspect exist.

What Happened

The author first spun up a local mitmproxy instance and routed VS Code's HTTPS traffic through it, using a self-signed certificate to decrypt the communication between Copilot and remote services. Along the way he recorded the metadata carried by completion requests, the model routing paths, and how the IDE and extension processes collaborate through local sockets. The article also provides a reproducible guide covering certificate installation, proxy forwarding, and log filtering so readers can repeat the setup on their own machines. The step-by-step nature is what makes the piece useful rather than merely illustrative, because proxying a hardened app is fiddly and easy to get wrong without instructions that anticipate the common failure points users hit.

The author notes the same trick works against other Electron-based assistants with only minor certificate tweaks and a fresh proxy profile.

Technical Details

Copilot's client does not talk to the large model directly; instead it sends requests to GitHub's gateway, which then handles authentication, rate limiting, and model selection before any inference happens. The request body includes signals such as the file context window, cursor position, and a repository structure summary that help the model ground its suggestions in the user's actual project. Because Electron apps share Chromium's network layer, the interception technique is broadly applicable to other AI desktop clients built on web technology—exactly why the article stresses that findings are transferable. The gateway design also explains why behavior can differ between the IDE surface and the underlying model behind it, since the gateway is free to add or strip fields the user never sees in the interface they trust.

Notably, the gateway sometimes rewrites prompts before they reach the model, which means the user's text is not always exactly what the model sees.

Versus Competitors

Compared with the black-box experience of closed-source commercial assistants, this reverse-engineering approach resembles the working style of security researchers who prefer to verify rather than trust a vendor's assurances. Products like Cursor and Windsurf, also based on Electron, can in principle be observed with the same method and reveal similar request shapes worth comparing across vendors. The difference lies in each vendor's gateway encryption strength and whether certificate pinning is enabled, the latter sharply raising the interception bar for outsiders. Some clients may also route through different regional endpoints, changing what a proxy actually captures in practice and how much useful detail survives the round trip back to the server that processed it.

Open-source assistants that run fully local avoid this entire class of issue, at the cost of some feature parity with hosted products.

Industry Impact and Use Cases

For ordinary users, such analysis helps answer "where exactly does my code get sent" and what context leaves the machine when a completion fires inside a private repository they believed was local. For enterprise security teams, it is a starting point for assessing the data-compliance of AI coding tools before they are rolled out to engineers who handle sensitive codebases daily. For the developer ecosystem, exposing runtime behavior pushes vendors toward better transparency about telemetry, retention, and what leaves the perimeter without consent. Simply put, putting an AI assistant behind a proxy for a look is both technical curiosity and a required course in privacy awareness that every organization adopting these tools should take seriously, because ignorance about data flow is no longer an acceptable excuse once the tool touches production code.

The piece is likely to trigger internal security reviews at firms that approved Copilot for developers without ever auditing its outbound traffic.