GitHub Copilot "YOLO Mode" Prompt Injection RCE

What to do

1. Update Visual Studio 2022 to 17.14.12 or later via the Visual Studio Installer.
2. Keep VS Code and the GitHub Copilot Chat extension on current releases.
3. Search user and workspace settings for `"chat.tools.autoApprove": true` and remove it unless deliberately set in an isolated environment.
4. Enforce the setting off via policy/managed settings for corporate developer machines.
5. Require review for commits that touch `.vscode/settings.json` or `.vscode/tasks.json`.

How to check if you are affected or compromised

• Grep for autoApprove: `grep -rn autoApprove ~/.config/Code/User .vscode 2>/dev/null` (adjust path on macOS/Windows).
• Check git history for unexpected edits to `.vscode/settings.json` or `tasks.json` made during Copilot agent sessions.
• Hunt for shells or network tools spawned by Code.exe / devenv.exe shortly after an agent session read external content.

What happened#

In its August 12, 2025 Patch Tuesday, Microsoft fixed CVE-2025-53773, "GitHub Copilot and Visual Studio Remote Code Execution Vulnerability," classified as CWE-77 command injection and scored CVSS 3.1 7.8 (Important). Johann Rehberger (Embrace The Red), who had reported it on June 29, published the details the same day.

The trick was simple. Copilot's agent could edit files in the workspace, including VS Code's own settings file, without asking. A prompt injection hidden in a source file, web page, GitHub issue or tool response told Copilot to add "chat.tools.autoApprove": true to .vscode/settings.json. That experimental setting, which Rehberger calls "YOLO mode," turns off user confirmation for tool calls. The injected instructions then had Copilot run terminal commands chosen for the host operating system. Rehberger reports it worked on Windows, macOS and Linux. He also showed variants using invisible Unicode instructions (unreliable in his tests) and described how the same approach could spread itself into other repositories, an "AI virus."

Who is affected#

MSRC's affected-product list names only Microsoft Visual Studio 2022 version 17.14, fixed in build 17.14.12. The CVE record lists 17.14.0 up to, but not including, 17.14.12. Rehberger's research targeted Copilot in VS Code, and he says the fix shipped in the August Patch Tuesday release. However, neither MSRC nor his post names a specific fixed VS Code or Copilot Chat build, which was not disclosed as of 2026-10-21. VS Code 1.103 (August 7, 2025) added re-trust prompts for changed MCP servers, but its release notes don't mention this CVE.

Do you really need to act?#

Exploitation needs a user running Copilot's agent over attacker-influenced content, which is common: pulling a repo, reading an issue, browsing docs. When published, MSRC rated the bug "Exploitation Less Likely," not exploited and not publicly disclosed. A detailed public proof of concept appeared the same day. Wiz lists a public exploit and no CISA KEV listing, and the local KEV snapshot as of October 2026 confirms it is not in the catalog.

VS Code and its extensions auto-update, so most individual developers are long since fixed. Two things justify a quick check. First, Visual Studio 2022 fleets in enterprises are often pinned. Second, the dangerous setting still exists, so someone can turn it on deliberately, or a repo can ship it pre-set. Separately, third-party analysis (which we could not confirm against Microsoft) argues the patch gated the agent's write to the settings file rather than how the setting is loaded.

What to do now#

1. Update Visual Studio 2022 to 17.14.12 or later through the Visual Studio Installer.
2. Keep VS Code and GitHub Copilot Chat current. Check under Help > About and in the Extensions view.
3. Find and remove auto-approve: search user and workspace settings.json files for chat.tools.autoApprove.
4. For managed fleets, enforce the setting off through policy and alert on repos that commit it.
5. Gate changes to .vscode/settings.json and .vscode/tasks.json behind code review, since both are code-execution surfaces.

How to tell if you were hit#

No indicators of compromise have been published. Look for "chat.tools.autoApprove": true that nobody remembers setting, and use git history to see when it appeared. In EDR, check for shells, PowerShell, curl or similar launched by Code or devenv.exe soon after an agent session handled external content. If you find any, rotate tokens and keys that were reachable from that workstation.

Timeline#

• Jun 29, 2025 — Rehberger reports the issue to Microsoft.
• Aug 12, 2025 — Patch Tuesday fix; CVE-2025-53773 published; Embrace The Red write-up released.
• Sep 8, 2025 — Latest MSRC revision of the advisory.

Vulnerability records

• CVE-2025-53773 · Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-53773: GitHub Copilot and Visual Studio Remote Code Execution Vulnerability msrc.microsoft.com
2. CVE Program — CVE-2025-53773 record (JSON) cveawg.mitre.org
3. Embrace The Red — GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773) embracethered.com
4. Wiz — CVE-2025-53773 vulnerability database entry wiz.io