At a glance
Critical 3 High 11 Medium 5
Severity reflects how directly a misconfiguration leads to credential theft, loss of production data or a supply-chain compromise. Audit check gives the GitHub Copilot Security Audit checks that detect it; "manual" means review it by hand.
The misconfigurations
Global auto-approve on: chat.tools.global.autoApprove, or the old chat.tools.autoApprove.
Why it matters. Johann Rehberger showed injected text making Copilot write this setting itself, which "will put GitHub Copilot in YOLO mode" and "disables all user confirmations", then run commands (Embrace The Red; CVE-2025-53773, CVSS 3.1 7.8 by Microsoft, fixed in Visual Studio 2022 17.14.12).
Fix. Remove the setting from user settings and enforce it off with the ChatToolsAutoApprove policy.
Workspace Trust off, or every folder trusted without reading it.
Why it matters. Tenable reported a file-name injection in Copilot Chat agent mode; Microsoft said "A solution will not be released" and that it should be mitigated by Workspace Trust (Tenable TRA-2025-53). Restricted mode disables agents (VS Code docs).
Fix. Keep security.workspace.trust.enabled on, open unknown folders in restricted mode, and read .vscode/ and .github/ before trusting them.
Broad terminal or edit auto-approve lists.
Why it matters. VS Code calls the terminal list "a best-effort convenience, not a security boundary" (VS Code docs): a listed command runs without asking, whatever its arguments.
Fix. Auto-approve only read-only commands such as git status and git diff; never shells, deletes, network tools, /.*/ or **/* edits.
The VS Code terminal sandbox and the Copilot CLI sandbox off (the default), or the sandbox on with network allowed.
Why it matters. Both sandboxes are off by default, and chat.agent.sandbox.allowNetwork defaults to true (VS Code docs, GitHub docs). Without them, agent commands run with your full permissions and network access.
Fix. Set chat.agent.sandbox.enabled to "on" with allowNetwork false, and sandbox.enabled in the CLI; organisations can enforce the first with ChatAgentSandboxEnabled.
VS Code, Visual Studio or the Copilot Chat extension not updated.
Why it matters. Microsoft fixed an agent that ran commands without confirmation (CVE-2026-70335, CVSS 3.1 7.8, VS Code 1.132.1), a path traversal security feature bypass (CVE-2026-45482, 8.4, Copilot Chat 1.123.2), a time-of-check race (CVE-2026-21523, 8.0, VS Code 1.110.1), credential disclosure (CVE-2026-47282, 6.5, VS Code 1.128.1) and command injection in Visual Studio (CVE-2026-21256, 8.8, 17.14.26). All scores are Microsoft's.
Fix. Keep VS Code, Visual Studio and the Copilot extensions on automatic updates, and track Microsoft's advisories.
Assigning issues to Copilot cloud agent without reading them.
Why it matters. Trail of Bits hid instructions in an issue that "is invisible to the maintainer when displayed in the GitHub user interface, but it is readable by the LLM", and got a backdoored pull request (Trail of Bits). Researchers later used HTML comments in an assigned issue to leak the agent's tokens, which GitHub called an "architectural limitation" (Comment and Control).
Fix. Read every issue before assigning it, restrict who can assign Copilot, and review the resulting pull request line by line.
Opening a Codespace from an issue you haven't read.
Why it matters. "A malicious GitHub issue can trigger a passive prompt injection in Copilot when a user launches a Codespace from that issue", which Orca used to obtain the GITHUB_TOKEN; GitHub patched it (Orca, RoguePilot).
Fix. Treat issues as untrusted input, and open Codespaces only from content you have read.
Unvetted MCP servers, or servers that read content outsiders can write.
Why it matters. Fake Sentry error events carrying "fix" instructions hijacked coding agents through an MCP server (Agentjacking, The Hacker News). Workspace MCP servers run as local processes once the folder is trusted (VS Code docs).
Fix. Keep an approved, pinned server list, enforce it with ChatMCP or ChatAllowedMcpServers, and give outsider-content servers read-only scopes.
Instruction files merged without review.
Why it matters. Pillar Security hid instructions in rules files with zero-width and bidirectional characters that steered Copilot and Cursor while staying invisible in review (Pillar Security). Copilot loads copilot-instructions.md, .instructions.md, AGENTS.md and CLAUDE.md (VS Code docs).
Fix. Put instruction files under CODEOWNERS and add a pre-commit check for hidden Unicode.
Cloud agent setup steps that download and run code.
Why it matters. The agent firewall doesn't apply to processes started by copilot-setup-steps.yml (GitHub docs).
Fix. Pin every action by SHA, install from your registries, and never pipe a download into a shell.
The cloud agent firewall turned off or widened, or MCP servers given broad secrets.
Why it matters. The firewall is on by default but doesn't cover MCP servers, and Copilot "will not ask for your approval" before using the MCP tools you configure (GitHub docs, GitHub MCP docs).
Fix. Keep the firewall and its recommended allowlist, list only the MCP tools you need, and pass only the COPILOT_MCP_ secrets they need.
Copilot CLI with allow-all flags, a --yolo alias, or broad saved approvals.
Why it matters. GitHub warns that "Scoping of permissions is heuristic"; saved approvals apply in that location from then on, and allow-all flags remove every prompt (GitHub docs).
Fix. Set permissions.disableBypassPermissionsMode to "disable", remove aliases, review permissions-config.json, and use --deny-tool to block commands the CLI must never run.
Symlinks with harmless names pointing at agent configuration or dotfiles.
Why it matters. Adversa showed approval prompts in five coding agents, Copilot among them, displaying the harmless link name while the write landed on the real target (Adversa, SymJack).
Fix. List links and their targets before trusting a repository, and delete links you didn't create.
Secrets in repositories Copilot can read, with no push protection.
Why it matters. In a sample of about 20,000 public repositories where Copilot is active, GitGuardian found that 6.4% leaked at least one secret, against 4.6% across all public repositories; it reports a correlation, not a proven cause (GitGuardian). CamoLeak got Copilot Chat, which acts with your permissions, to leak private source code; GitHub fixed it by disabling image rendering in Copilot Chat (Legit Security).
Fix. Turn on secret scanning with push protection, keep .env files ignored, and rotate anything that has been committed.
Repository hooks, plugins and marketplaces accepted without review.
Why it matters. Hooks in .github/hooks/ and .github/copilot/settings.json run for everyone who uses the Copilot CLI in the repository, and its plugins install code (GitHub docs). AIR Security reported that a plugin pinned by commit could be swapped on update, and that Microsoft had not shipped a fix for Copilot (AIR Security, Plugin4Shell).
Fix. Read hook and plugin entries before running the CLI in a repository; organisations can set ChatAllowManagedHooksOnly.
Opening a repository that arrived with its own .git/config.
Why it matters. core.hooksPath, core.fsmonitor and filter drivers run programs during ordinary git commands, which agents run constantly; coding-agent CVEs have used exactly this (CVE-2026-19593). A normal git clone never copies .git/config.
Fix. Re-clone repositories you received as archives or folders, or remove program-running keys first.
Content exclusions treated as a boundary for agents.
Why it matters. Content exclusion is "not supported in Edit and Agent modes of Copilot Chat in Visual Studio Code and other editors" (GitHub docs).
Fix. Keep secrets out of repositories instead, and use the sandbox to keep agents away from credential files.
Organisations relying on each developer's settings instead of policies.
Why it matters. Users can change their own settings at any time; only policies delivered by MDM, the registry or /etc/vscode/policy.json are enforced (VS Code enterprise policies).
Fix. Deploy the policies below, and set the matching GitHub Copilot policies for the organisation.
No export of Copilot audit logs.
Why it matters. Enterprise audit log events for Copilot are kept for 180 days and don't contain prompts (GitHub docs).
Fix. Stream the audit log to your SIEM and retain it according to policy.
Fix order
Work through them in this sequence, finishing each step before starting the next:
- Stop the worst exposure: X1, X2, X5, X6. Turn global auto-approve off, keep Workspace Trust on, update everything, and stop assigning unread issues to the cloud agent.
- Contain the agent: X3, X4, X12, X14. Narrow auto-approve lists, turn the sandboxes on with network off, lock down the CLI, and stop secrets reaching repositories.
- Govern extensions and repositories: X7, X8, X9, X10, X11, X13, X15, X16. Vet MCP servers, instruction files, hooks, plugins, setup steps and repositories before trusting them.
- Close the rest: X17, X18, X19. Enforce policies, stop relying on content exclusions, export audit logs, then re-run the audit against your new baseline.
One VS Code policy file
For organisations, this example enforces the settings behind X1, X4 (for VS Code) and X18, and parts of X8 and X15, on every device that receives it: global auto-approve off, the terminal sandbox on, MCP limited to your registry, third-party extension tools off, and hooks from managed sources only. On Linux it goes in /etc/vscode/policy.json; on Windows and macOS the same policy names are delivered through the registry or a configuration profile. ChatMCP: "registry" needs a registry set with McpGalleryServiceUrl. It doesn't govern the Copilot CLI or cloud agent. Check every policy against the VS Code policy reference for the versions you run.
{
"ChatToolsAutoApprove": false,
"ChatAgentSandboxEnabled": true,
"ChatMCP": "registry",
"ChatAgentExtensionTools": false,
"ChatAllowManagedHooksOnly": true
}Sources
- VS Code and GitHub documentation: AI settings reference, Tool approvals, Agent sandbox, Enterprise policies, Copilot CLI configuration, Cloud agent risks and mitigations.
- Incidents and research: MSRC, CVE-2025-53773 · Embrace The Red, Copilot YOLO mode · CVE-2026-70335 · CVE-2026-45482 · CVE-2026-21523 · CVE-2026-47282 · CVE-2026-21256 · Tenable TRA-2025-53 · Trail of Bits · Comment and Control · Orca, RoguePilot · Legit Security, CamoLeak · Pillar Security, Rules File Backdoor · GitGuardian, Copilot and secret leaks · Agentjacking · AIR Security, Plugin4Shell · Adversa, SymJack
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with GitHub or Microsoft.