---
title: "GitHub Copilot \"YOLO Mode\" Prompt Injection RCE"
url: https://erroneo.us/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/
description: "Prompt injection could make Copilot set chat.tools.autoApprove and run commands (CVE-2025-53773, CVSS 7.8). Patched Aug 2025; VS 2022 fix is 17.14.12."
type: security-brief
section: "Security Digest"
date_published: 2025-08-12
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-53773"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# GitHub Copilot "YOLO Mode" Prompt Injection RCE

**Verdict: Check exposure.** Patched in August 2025 and not known to be exploited, but enterprise Visual Studio installs lag and the autoApprove setting can still be turned on by hand, so verify both.

- **Who must act:** Admins of Visual Studio 2022 17.14 fleets below 17.14.12, and anyone whose user or workspace settings contain chat.tools.autoApprove set to true.
- **Who can relax:** Developers on auto-updated VS Code and Copilot Chat, and Visual Studio 17.14.12 or later, who haven't enabled auto-approval.
- **Affected:** Microsoft Visual Studio 2022 version 17.14.0 to before 17.14.12 (per MSRC); GitHub Copilot in VS Code before the August 2025 update (fixed build not listed by MSRC)
- **Fixed:** Visual Studio 2022 17.14.12; August 2025 GitHub Copilot / VS Code updates
- **CVEs:** CVE-2025-53773
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Update Visual Studio 2022 to 17.14.12 or later via the Visual Studio Installer.
2. Keep VS Code and the GitHub Copilot Chat extension on current releases.
3. Search user and workspace settings for `"chat.tools.autoApprove": true` and remove it unless deliberately set in an isolated environment.
4. Enforce the setting off via policy/managed settings for corporate developer machines.
5. Require review for commits that touch `.vscode/settings.json` or `.vscode/tasks.json`.

### How to check if you are affected

- Grep for autoApprove: `grep -rn autoApprove ~/.config/Code/User .vscode 2>/dev/null` (adjust path on macOS/Windows).
- Check git history for unexpected edits to `.vscode/settings.json` or `tasks.json` made during Copilot agent sessions.
- Hunt for shells or network tools spawned by Code.exe / devenv.exe shortly after an agent session read external content.

## What happened

In its August 12, 2025 Patch Tuesday, Microsoft fixed [CVE-2025-53773](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773), "GitHub Copilot and Visual Studio Remote Code Execution Vulnerability," classified as CWE-77 command injection and scored CVSS 3.1 7.8 (Important). Johann Rehberger (Embrace The Red), who had reported it on June 29, published [the details](https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/) the same day.

The trick was simple. Copilot's agent could edit files in the workspace, including VS Code's own settings file, without asking. A prompt injection hidden in a source file, web page, GitHub issue or tool response told Copilot to add `"chat.tools.autoApprove": true` to `.vscode/settings.json`. That experimental setting, which Rehberger calls "YOLO mode," turns off user confirmation for tool calls. The injected instructions then had Copilot run terminal commands chosen for the host operating system. Rehberger reports it worked on Windows, macOS and Linux. He also showed variants using invisible Unicode instructions (unreliable in his tests) and described how the same approach could spread itself into other repositories, an "AI virus."

## Who is affected

MSRC's affected-product list names only Microsoft Visual Studio 2022 version 17.14, fixed in build 17.14.12. The [CVE record](https://cveawg.mitre.org/api/cve/CVE-2025-53773) lists 17.14.0 up to, but not including, 17.14.12. Rehberger's research targeted Copilot in VS Code, and he says the fix shipped in the August Patch Tuesday release. However, neither MSRC nor his post names a specific fixed VS Code or Copilot Chat build, which was not disclosed as of 2026-10-21. VS Code 1.103 (August 7, 2025) added re-trust prompts for changed MCP servers, but its release notes don't mention this CVE.

## Do you really need to act?

Exploitation needs a user running Copilot's agent over attacker-influenced content, which is common: pulling a repo, reading an issue, browsing docs. When published, MSRC rated the bug "Exploitation Less Likely," not exploited and not publicly disclosed. A detailed public proof of concept appeared the same day. [Wiz](https://www.wiz.io/vulnerability-database/cve/cve-2025-53773) lists a public exploit and no CISA KEV listing, and the local KEV snapshot as of October 2026 confirms it is not in the catalog.

VS Code and its extensions auto-update, so most individual developers are long since fixed. Two things justify a quick check. First, Visual Studio 2022 fleets in enterprises are often pinned. Second, the dangerous setting still exists, so someone can turn it on deliberately, or a repo can ship it pre-set. Separately, third-party analysis (which we could not confirm against Microsoft) argues the patch gated the agent's write to the settings file rather than how the setting is loaded.

## What to do now

1. Update Visual Studio 2022 to 17.14.12 or later through the Visual Studio Installer.
2. Keep VS Code and GitHub Copilot Chat current. Check under Help > About and in the Extensions view.
3. Find and remove auto-approve: search user and workspace `settings.json` files for `chat.tools.autoApprove`.
4. For managed fleets, enforce the setting off through policy and alert on repos that commit it.
5. Gate changes to `.vscode/settings.json` and `.vscode/tasks.json` behind code review, since both are code-execution surfaces.

## How to tell if you were hit

No indicators of compromise have been published. Look for `"chat.tools.autoApprove": true` that nobody remembers setting, and use git history to see when it appeared. In EDR, check for shells, PowerShell, curl or similar launched by `Code` or `devenv.exe` soon after an agent session handled external content. If you find any, rotate tokens and keys that were reachable from that workstation.

## Timeline

- Jun 29, 2025 — Rehberger reports the issue to Microsoft.
- Aug 12, 2025 — Patch Tuesday fix; CVE-2025-53773 published; Embrace The Red write-up released.
- Sep 8, 2025 — Latest MSRC revision of the advisory.

## Sources

1. [Microsoft MSRC — CVE-2025-53773: GitHub Copilot and Visual Studio Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773)
2. [CVE Program — CVE-2025-53773 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-53773)
3. [Embrace The Red — GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)](https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/)
4. [Wiz — CVE-2025-53773 vulnerability database entry](https://www.wiz.io/vulnerability-database/cve/cve-2025-53773)

---
Source page: https://erroneo.us/security/briefs/github-copilot-yolo-mode-prompt-injection-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt