Copilot Escapes Its Sandbox Through One Tiny Dot

What happened

Microsoft patched a flaw in Copilot for Visual Studio and SQL Server Management Studio that let the AI agent write to protected settings and MCP configuration files via a trailing-dot filename, enabling arbitrary command execution. The researcher also demonstrated indirect prompt injection exploits. Microsoft rated the flaw Important severity (CVSS 8.8) and shipped the fix on October 13, 2026, but awarded a $0 bounty.