The incident: CVE-2025-53773
Johann Rehberger showed that a prompt injection planted in a source file, web page, GitHub issue or tool response could make Copilot add "chat.tools.autoApprove": true to a VS Code settings file. That setting “will put GitHub Copilot in YOLO mode. And it disables all user confirmations”, after which the injected instructions ran commands on the developer’s machine (Embrace The Red).
The agent edited its own safety settings, and nobody approved a command. Microsoft published the fix in August 2025 (CVE-2025-53773, CVSS 3.1 7.8 by Microsoft, fixed in Visual Studio 2022 17.14.12). Global auto-approve can no longer be set from a workspace.