AIA-012 GitHub Copilot in VS Code: prompt injection could enable auto-approve and run code (CVE-2025-53773), per Embrace The Red

ID: AIA-012
Category: AI AI agent incident
Disclosed: 2025-08
Systems: GitHub Copilot (VS Code agent mode)
Harm type: Prompt injection / code exec
Status: fixed
Rehberger writes: "With the August Patch Tuesday release this is now fixed."
CVE: CVE-2025-53773
CISA KEV: Not in CISA KEV as of catalog 2026.10.30
Checked 2026-10-31 against catalog 2026.10.30

Summary

Johann Rehberger reported that a prompt injection could make GitHub Copilot write "chat.tools.autoApprove": true into VS Code settings ("YOLO mode") and then run commands without approval. He reported it on June 29, 2025, and he says it was fixed in Microsoft's August 2025 Patch Tuesday.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

SI-10 Information Input Validation
CM-5 Access Restrictions for Change
AC-6 Least Privilege

Human-approval (JCR) checkpoint

partial: approval gate the agent could disable by editing a settings file

Sources

embracethered.com primary link checked 2026-10-31, HTTP 200
Post dated Aug 12, 2025
https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.