A trailing dot let Copilot in Visual Studio rewrite its own guardrails, enabling code execution

Security researcher Johann Rehberger, who publishes as Embrace The Red, has detailed a remote code execution flaw in the GitHub Copilot agent built into Microsoft Visual Studio and SQL Server Management Studio (SSMS). Microsoft fixed the issue, tracked as CVE-2026-103572, in its October 2026 Patch Tuesday on 13 October. The company rates it Important with a CVSS score of 8.8, according to the researcher.

How the bypass worked

Copilot is supposed to ask the user before modifying sensitive files such as .mcp.json, which declares the Model Context Protocol servers the IDE may launch, and the editor's settings file. The check compared the requested filename against a list of protected names. Rehberger found that appending a dot, as in .mcp.json., made the name look different to that check. Windows then silently strips the trailing dot when writing, so the change lands on the protected file anyway.

From there, an agent could register a new MCP server and enable it, causing the IDE to start an attacker-chosen command. In Visual Studio, a second route was to change the path of the ripgrep search tool so that another executable ran whenever Copilot searched code. The researcher also described path traversal inside a trusted extensions folder that helped locate the settings file in SSMS. His proof of concept opened the Windows calculator.

The trigger does not need a malicious user: indirect prompt injection hidden in a repository file or in data returned by an MCP server could steer the agent into making these writes.

Fix and timeline

According to the researcher's analysis, Microsoft now normalizes paths with GetFullPath before the check, which removes trailing dots and resolves .. segments. Daily CyberSecurity lists fixed builds 17.14.42 and 18.10.4 and says Microsoft had not seen active exploitation. The flaw was reported on 4 August 2026 and confirmed on 16 September; Rehberger says it was deemed out of scope for the bug bounty.

Why it matters

The case illustrates a recurring weakness in coding agents: controls that the agent itself can reach are only as strong as the code that enforces them. Rehberger recommends designing guardrails that still hold if the agent is hijacked, and keeping agents away from configuration that controls which tools run. Until updates are applied, avoiding untrusted repositories and unverified MCP servers in Copilot sessions reduces exposure.