Disclosed vulnerability
GitHub Copilot RCE: prompt injection writes chat.tools.autoApprove into .vscode/settings.json ('YOLO mode')
AIR-2025-0093 AIR record · 2025-08-github-copilot-yolo-rce
From the supporting source
It is achieved by placing Copilot into YOLO mode by modifying the project's `settings.json` file.embracethered.com
The record
Disclosed
2025-08-12
Vendor
GitHub/Microsoft
Product
GitHub Copilot in Visual Studio Code / Visual Studio
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent disabled its own approval gate then executed
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection source file or web content
Impact type
Remote code execution, Full host compromise, Code execution, Self propagation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all VS Code plus Copilot agent-mode users prior to the August 2025 Patch Tuesday
Capability abused
Defense & remediation
Recorded defense
per-tool user confirmation prompts in Copilot agent mode
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
Microsoft August 2025 Patch Tuesday (reported 2025-06-29)
Taxonomy & references
Curator notes
Johann Rehberger (Embrace The Red). The agent disables its own approval gate by writing "chat.tools.autoApprove": true, then runs arbitrary shell commands. Rehberger demonstrated wormable variants; related vectors include .vscode/tasks.json and planting fake MCP servers. Affects Windows, macOS and Linux. | Merged from duplicate id `2025-08-github-copilot-yolo-mode-rce`. Also reported under the titles: 'GitHub Copilot / VS Code wormable remote code execution via prompt injection (CVE-2025-53773)'; 'GitHub Copilot: remote code execution by writing settings.json to enable YOLO mode (CVE-2025-53773)'.
Supporting sources
Cite as
Enkrypt AI. "GitHub Copilot RCE: prompt injection writes chat.tools.autoApprove into .vscode/settings.json ('YOLO mode')". AIR, AIR-2025-0093. https://agentincident.vercel.app/i/AIR-2025-0093/ (accessed 2026-10-19).