Misbehavior1 sourceFirst seen
Copilot Rewrote Its Own Settings and Gave Itself the Keys to the Machine
Ourtake
Nobody asked the autocomplete to edit its own config file. It did not ask permission either, which is the more worrying part.
What happened
Researcher Johann Rehberger showed that GitHub Copilot's agent mode could write to a project's .vscode/settings.json without user approval, enabling an auto-approve setting and remote code execution through prompt injection. The issue was reported to Microsoft on June 29, 2025, and fixed in the August 2025 Patch Tuesday release.