CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands

Vulnerability · GitHub Copilot · HIGH

Incident dateNot stated

DisclosedAug 12, 2025 (Microsoft and researcher). Reported privately Jun 29, 2025.

Added hereOct 14, 12:16 AM ET

Last verifiedOct 14, 2026

Summary

Researcher Johann Rehberger (Embrace The Red) showed that injected instructions in a file, web page or issue could make Copilot's agent write "chat.tools.autoApprove": true into VS Code settings. That turns off confirmation prompts, after which the agent can run shell commands. Microsoft fixed it in the August 2025 Patch Tuesday release. NVD lists CVSS 7.8 High.

Severity

HIGH Code execution on a developer machine from untrusted content. Requires the user to trigger the payload (UI:R). Fixed by Microsoft.

Timeline

Jun 29, 2025
Reported to Microsoft; MSRC confirms it was already tracking the issue.
Aug 12, 2025
Fixed in Patch Tuesday; CVE published. For Visual Studio 2022 version 17.14, Microsoft lists 17.14.12 as the fixed build.

How it happened

The agent was allowed to edit its own configuration file without asking. One setting in that file disabled every approval prompt. Once a prompt injection got the agent to change it, nothing stood between the injected text and the terminal. Microsoft titles it a remote code execution vulnerability, while its CVSS vector scores the attack as local (AV:L) and needing user interaction. Rehberger also credits Markus Vervier of Persistent Security, who reported the same issue.

How to check your app

Update VS Code, Visual Studio and the Copilot extension.
Check .vscode/settings.json in your repos and user settings for chat.tools.autoApprove and remove it.
Treat settings and MCP config changes made by an agent as something to review in every diff.

Sources

Corrections and updates

Oct 14, 2026
Narrowed the version claim to what Microsoft lists (17.14.12 is the fixed build for 17.14), and removed a statement about Microsoft's explanation of 'Remote' that we could not find in the current advisory.
Oct 14, 2026
Added the researcher's credit to Markus Vervier, who reported the same issue.

If you want a quick way to check the basics above on your own app, LockedVibe publishes a free Lockdown Pack with the prompts and checks for RLS, auth and exposed keys.