Copilot Security Assessment

The question it answers

For every place GitHub Copilot runs: if injected text hijacked the agent right now, what could it reach, and would you know? Everything below is a way of answering that question with evidence rather than assumptions.

Developer assessment (1 hour)

1. Run the audit (about a minute). The Copilot Security Audit container checks your VS Code and Copilot CLI settings, MCP servers and a project of your choice, offline and read-only. Save the HTML report.
2. Work through the checklist. Items marked "manual" are the ones the audit cannot see: your seat, organisation policies, the cloud agent and working habits.
3. Compare against the common misconfigurations and fix every Critical one first.
4. Prove the controls work with the ten-minute self-test below.
5. Keep the evidence: the audit report, the completed checklist and the test results. Re-run after each upgrade and at least monthly.

The ten-minute self-test

Configuration you haven't tested may not do what you think. Make a throwaway project containing a fake .env, apply the baseline settings, and try each of the following. Every one should be refused or stopped for your approval.

The settings it tests are in the audit's fix section. Re-run it after every VS Code, extension or CLI upgrade.

Team assessment method

For a team or organisation, allow two to four weeks across 6 phases:

1. Scope and inventory. List the surfaces in use (VS Code agent mode, Visual Studio, JetBrains, the Copilot CLI, Copilot cloud agent, Codespaces), seat types, versions, MCP servers, extensions, plugins, hooks and the repositories where the cloud agent is enabled. Useful sources: the Copilot seat report, EDR process inventory and a code search for .vscode/mcp.json, .github/copilot-instructions.md and .github/hooks/.
2. Threat model. For each place Copilot runs (laptop, Codespace, cloud agent runner), write down the identities and tokens it holds and the repositories, data and systems it can reach. That list is your blast radius.
3. Configuration review. Compare each developer's VS Code and CLI settings, the deployed policies, and the organisation's Copilot and cloud agent settings with the checklist. On each developer machine, the audit container does the local part in about a minute.
4. Technical testing. Try to break it, safely, in a test repository: ask the agent to enable global auto-approve, read a planted fake secret, reach a host that is not allowed, open a crafted repository with a project MCP server and an instruction-file injection, and assign a crafted issue to the cloud agent in a sandbox repository. Each attempt should be both blocked and detected.
5. Detection and response review. Confirm the Copilot audit log is streaming; check that your alerts fire on the test activity from phase 4; run a tabletop for "the agent leaked a token" and "an agent pull request carried a backdoor".
6. Report and roadmap. Record findings with their misconfiguration IDs, score each domain with the maturity model below, and write a plan that fixes them in order of risk, following the fix order.

Enterprise checklist

Use these as the evidence behind each maturity score.

Governance

• An approved policy for AI-assisted development, published and acknowledged.
• Named owners for VS Code policies, Copilot organisation policies, MCP and extension intake, detections and incident response.
• Controls mapped to the frameworks you report against (OWASP Top 10 for Agentic Applications, NIST AI RMF, ISO/IEC 42001, SOC 2 change management).

Identity and access

• SSO with phishing-resistant MFA for GitHub; Copilot seats assigned through teams and reviewed quarterly.
• Who can assign issues to the cloud agent is restricted to people who triage them.
• Automation uses fine-grained, repository-scoped tokens, not personal tokens.

Policy enforcement

• VS Code policies delivered by MDM, the Windows registry or /etc/vscode/policy.json, and verified on a sample of devices.
• ChatToolsAutoApprove off and ChatAgentSandboxEnabled on; MCP limited with ChatMCP or ChatAllowedMcpServers; hooks limited with ChatAllowManagedHooksOnly.
• Extensions limited with AllowedExtensions.
• Copilot organisation policies set for features, models, MCP servers and cloud agent access.

Data protection

• Secret scanning with push protection on every repository.
• Content exclusions configured as hygiene, with the knowledge that agent mode ignores them.

Endpoint and network

• EDR on every developer host, and inside WSL, dev containers and Codespaces where required.
• Corporate proxy and CA configured; an egress allowlist for model endpoints and package registries.
• A standard container or Codespace with no credentials for untrusted code.

CI/CD, cloud agent and production

• The cloud agent enabled only on repositories with rulesets that require review and passing checks, including on copilot/ branches.
• The agent firewall on; "Approve and run workflows" required; setup steps pinned and reviewed.
• CODEOWNERS on .github/**, .vscode/**, instruction files and lockfiles.
• No agent has standing write access to production; a break-glass procedure is documented.

Observability and response

• The enterprise audit log streamed to the SIEM and retained beyond 180 days where policy requires.
• Detections for agent activity deployed and tested, including changes to .vscode/settings.json and new MCP servers.
• Runbooks for a leaked token, an injected agent action, a malicious MCP server or extension, and a backdoored agent pull request; a tabletop run in the last 12 months.

Threat intelligence and testing

• Microsoft and GitHub advisories for VS Code, Visual Studio and Copilot followed, with a regular summary for the team.
• The phase 4 tests re-run after each upgrade and policy change.
• Copilot in the scope of the annual penetration test or red team.

Maturity model

Score each domain from 0 to 4 and track it quarterly.

A sensible first target for most organisations is level 2 everywhere, and level 3 for policy enforcement, isolation and CI/CD, because those three domains carry most of the critical risks.

Score it

Pick a level for each domain. The weighted score updates as you go; nothing is sent anywhere.

Weighted score: 0.0 of 4 · Unmanaged

Sources

• VS Code and GitHub documentation: AI settings reference, Tool approvals, Agent sandbox, Enterprise policies, Copilot CLI configuration, Cloud agent risks and mitigations.
• Why each control matters, with incident sources: Common Copilot Misconfigurations.
• Frameworks: OWASP GenAI Security Project, NIST AI RMF, ISO/IEC 42001.

The domain weights and maturity levels are AISecurityLabs.org guidance, not a standard; adjust them to your risk profile. Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with GitHub or Microsoft.