Case copilot-yolo-mode-cve-2025-53773Agent hijackUnited States
Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773)
Injected text in files, web pages or GitHub issues could make Copilot write chat.tools.autoApprove into .vscode/settings.json, disabling confirmations and allowing shell commands. Microsoft patched it in August 2025.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 12, 2025
- Location
- United States
- Target
- GitHub Copilot in Visual Studio and VS Code
- Severity
- High
- Triggered by
- Johann Rehberger (Embrace The Red)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2025-53773
What happened
Injected text in files, web pages or GitHub issues could make Copilot write chat.tools.autoApprove into .vscode/settings.json, disabling confirmations and allowing shell commands. Microsoft patched it in August 2025.
Impact: Full code execution on developer machines with the potential for worm-like spread through shared repositories; no exploitation in the wild reported
Who triggered it
Actor: Johann Rehberger (Embrace The Red)
Attribution: Credited to Johann Rehberger; fixed by Microsoft in the August 2025 Patch Tuesday release
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in code comments, project files or issues the agent reads, causing Copilot to edit workspace settings and enable unattended tool execution
Root cause: Copilot could modify its own security-relevant configuration file without user confirmation, turning any prompt injection into code execution
Timeline
- Rehberger reports the issue to Microsoft
- Microsoft publishes CVE-2025-53773 (CVSS 7.8) and ships a fix
- Researchers note VS Code now prompts before Copilot edits settings.json
Response
Microsoft patched Visual Studio and the Copilot extension and added a confirmation when the agent edits .vscode/settings.json
Current status: Patched
Sources (open in a new tab)
- Wiz vulnerability database wiz.io
- Cyber Security News cybersecuritynews.com
- Repello AI repello.ai
Cite this case
Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773). AI Threat Watch, case copilot-yolo-mode-cve-2025-53773, Aug 12, 2025. https://aithreat.io/cases/copilot-yolo-mode-cve-2025-53773/
Permanent link: https://aithreat.io/cases/copilot-yolo-mode-cve-2025-53773/