Executive brief
Microsoft Visual Studio Code's CoPilot Chat extension contains a security feature bypass vulnerability that can be exploited over a network by an unauthorized attacker. This could allow attackers to circumvent intended security controls protecting developer workflows and sensitive code interactions within the IDE.
Technical details
A security feature bypass vulnerability exists in the Visual Studio Code CoPilot Chat Extension. The vulnerability allows an unauthorized attacker to bypass a security feature via a network vector without requiring authentication. An attacker can exploit this to circumvent intended security controls. Microsoft has released a security update to address this issue; users should apply the patch immediately.
Affected products
- Microsoft Visual Studio Code CoPilot Chat Extension
Timeline
- 2026-08-11: disclosed