Sources
- VS Code documentation: AI settings reference · Tool approvals · Agent sandbox · Security · Workspace Trust · Enterprise policies
- GitHub documentation: Copilot CLI configuration · Allowing tools · Cloud agent risks and mitigations · Content exclusion
- Vulnerabilities: MSRC, CVE-2025-53773 · CVE-2026-70335 · CVE-2026-45482 · Tenable, TRA-2025-53
- Research: Embrace The Red, Copilot YOLO mode · Trail of Bits · Comment and Control · Orca, RoguePilot · Legit Security, CamoLeak · Pillar Security · GitGuardian
This post is informational and comes with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with GitHub or Microsoft. GitHub Copilot and VS Code are trademarks of their owners, used here only to identify the products.