2026-05-12 · 2026-Q2
GitHub Copilot and VS Code Security-Feature Bypass (CVE-2026-41109)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
GitHub Copilot extension before v1.43.20260512 and Visual Studio Code up to 1.96.x (fixed in VS Code 1.97.0)
Impact
A low-privileged local attacker can bypass Copilot's user-consent prompts and content filters, inject malicious code suggestions, silently disable telemetry consent, and leak environment variables and API keys through suggestion logging
Root cause
Improper validation of inter-process communication between the Copilot extension and the VS Code core when the workspace was marked trusted; the flaw is in the integration layer, not the model
CVE
Sources
Catalog
Cite this: AgentProv incident record: GitHub Copilot and VS Code Security-Feature Bypass (CVE-2026-41109) (2026-05-12). https://agentprov.com/incidents/2026-05-12-github-copilot-and-vs-code-security-feature-bypass-cve-2026-41109
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run