CVE-2026-102232: Copilot agent sessions in VS Code could edit hook files without asking

Vulnerability · GitHub Copilot (VS Code) · HIGH

Incident dateNot stated

DisclosedOct 13, 2026 (Microsoft security update, VS Code advisories and NVD, all four CVEs).

Added hereOct 14, 8:20 AM ET

Last verifiedOct 14, 2026

Summary

Microsoft fixed four AI-related security issues in VS Code 1.141.1 on Oct 13, 2026. In CVE-2026-102232, GitHub Copilot agent sessions backed by the local Copilot harness treated custom hook and agent-definition files as ordinary workspace files and could edit them without the usual approval prompt. Through prompt injection, an attacker could get the agent to add a shell command to a hook, which then ran with the user's privileges the next time the hook fired. In CVE-2026-102851, sandbox permissions approved for one MCP server were saved in shared settings, so other MCP servers using the same configuration got them too. In CVE-2026-102231, an experimental workspace setting let a workspace override the Azure DevOps code search endpoint, so a malicious workspace could send Copilot code search requests and the user's Azure DevOps token to a server the attacker controls. In CVE-2026-70098, opening a workspace through the vscode.dev/agents/tunnel web path skipped workspace trust, so agent skills supplied by an attacker could run without a warning. Microsoft lists all four as not publicly disclosed and not exploited when it released the fix.

Severity

HIGH Commands run on the developer's machine from content the agent reads, with no approval prompt. It needs hooks enabled with a custom hook or agent-definition location, and a Copilot-harness session run against attacker-controlled content. Microsoft scores it CVSS 3.1 7.0 High and rates it Important. The MCP sandbox issue is scored 6.1 Medium. Microsoft scores CVE-2026-70098 at 8.8 High and CVE-2026-102231 at 7.7 High, and rates both Important.

Timeline

Oct 13, 2026
Microsoft publishes CVE-2026-102232, CVE-2026-102851, CVE-2026-102231 and CVE-2026-70098 in its October 2026 security updates, all rated Important.
Oct 13, 2026
Advisories GHSA-fq62-m6f5-c7h9, GHSA-qghm-w43w-vx8v, GHSA-m8rw-hr26-pw53 and GHSA-r2p5-jgfw-r5vw are published on the VS Code repository. Each lists versions before 1.141.1 as affected and 1.141.1 as fixed.
Oct 13, 2026
NVD publishes all four CVEs.

How it happened

VS Code lets users point the chat.hookFilesLocations and chat.agentFilesLocations settings at folders in the workspace. Hooks run shell commands at set points in an agent session. Before 1.141.1, the Copilot harness auto-approved edits to those locations like any other file, so an agent steered by prompt injection could plant a command in a hook without the user seeing a prompt. The fix treats those locations as sensitive and asks for confirmation for direct writes and shell redirections, including through symbolic links and case-insensitive paths. Microsoft lists it as CWE-863 and rates attack complexity high because it takes several steps: prompt injection, Copilot agent interaction, and then triggering a build. The MCP issue (CWE-266) is fixed by scoping sandbox approvals to each server. Microsoft says exploiting it would need the user to add and start a crafted MCP server alongside another sandboxed server. CVE-2026-102231 came from an experimental setting, github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride, which a workspace could use to point Azure DevOps code search at another server. The attacker would need the user to open a crafted workspace and trigger Azure DevOps code search. The fix removes the override, so requests always go to the expected Azure DevOps endpoint. Microsoft lists it as CWE-41 and describes the impact as a Workspace Trust bypass. The GitHub advisory's text says the fix is available starting with 1.136.2, while its affected-versions field, Microsoft and NVD list 1.141.1. For CVE-2026-70098 (CWE-862), the attacker would need the user to open the workspace on the vscode.dev/agents/tunnel path and run sessions on it. Microsoft notes that the user does not need to grant trust. The fix adds workspace trust to that endpoint.

How to check your app

Open Help > About in VS Code and make sure you are on 1.141.1 or later.
If you cannot update yet, Microsoft's workaround is to set chat.useHooks and chat.useClaudeHooks to false, or remove custom entries in chat.hookFilesLocations and chat.agentFilesLocations.
Look through your hook and agent-definition files for commands you did not add.
Only run MCP servers you trust, and do not approve extra network or file-write access in a configuration shared with servers you do not trust.
If you cannot update yet and use Azure DevOps code search, disable it and remove the github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride setting from workspace configuration.
Do not open untrusted workspaces through the vscode.dev/agents/tunnel web path.

Sources

Corrections and updates

Oct 14, 2026
Added CVE-2026-102231 and CVE-2026-70098, fixed in the same VS Code 1.141.1 release.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.