Copilot flaw in Visual Studio let an agent rewrite its own config
A trailing dot in a file name could get past Copilot's edit approval in Visual Studio and lead to code running on the machine. Microsoft fixed it in October.
On 13 October 2026, Microsoft's Patch Tuesday included a fix for CVE-2026-103572, a remote code execution flaw in GitHub Copilot for Visual Studio. Security researcher Johann Rehberger found it and reported it in August. Microsoft rated it Important, with a CVSS score of 8.8.
Copilot is meant to ask for approval before an agent edits sensitive files such as .mcp.json. Rehberger found that the check compared file names as plain text. Windows quietly drops a trailing dot from a file name, so an edit to .mcp.json. passed the check and landed on the protected file with no prompt.
An attack starts with prompt injection, through a file the agent opens or output from an MCP server. Rehberger showed two chains. In one, the agent adds an attacker's MCP server to the config and the editor starts its command. In the other, it changes the path of a search tool in the settings, so the next Copilot search runs a program of the attacker's choice.
Rehberger says SQL Server Management Studio shares the vulnerable component. A Cloud Security Alliance note says Microsoft's affected-product list names only Visual Studio, so people using that tool should confirm the update for their build. The same note gives the fixed builds as 17.14.42 for Visual Studio 2022 and 18.10.4 for Visual Studio 2026.
Why it matters
The approval prompt was the safety control here, and a small text comparison was enough to get past it. An agent that can change its own settings can give itself more reach than its owner agreed to.
Config files are a useful target because they turn a text edit into a running program. The same file can sit in many projects, so a change is easy to miss.
Rehberger's wider point is that security controls should still hold if the agent itself has been taken over.
What you can do
- Install the October 2026 security update for Visual Studio, and check your build number.
- Check SQL Server Management Studio separately if you use Copilot there.
- Look at
.mcp.jsonand your editor settings for servers or tool paths you did not add. - Treat files and tool output from outside your team as untrusted when an agent is reading them.
- Run agents with the smallest rights that work, and do not rely on approval prompts alone.
Prycheck can list the MCP and agent configs on your computer, which makes an unfamiliar entry easier to spot.
Sources
- Embrace The Red: Visual Studio Copilot remote code execution
- Cloud Security Alliance: MCP launch paths research note
Source: Embrace The Red