Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-13

HighPrimary

Copilot Trailing-Dot Path Bypass Can Launch Commands in Visual Studio and SSMS

A controlled Copilot demonstration bypassed protected settings with trailing-dot paths, launching Calculator and malicious MCP server commands in Windows IDEs.

GitHub Copilot in Visual Studio and SSMSTool execution / MCPControlled indirect prompt-injection demonstration composed with a protected-path canonicalization bypassWindows Visual Studio and SQL Server Management Studio sharing the affected Microsoft.VisualStudio.Copilot.Core.dll

What happened

Copilot wrote protected configuration through trailing-dot filenames. The IDE then launched Calculator through a replaced search executable or a command registered as an enabled MCP server.

Why it matters

No production impact was established. The controlled demonstrations showed process execution in the researcher's Visual Studio and SSMS environments.

Missing authorization check

Authorization bound to the canonical destination and configuration change, followed by a separate check for the exact process the IDE would launch.

Would PP block it?

A gate would need to authorize the canonical path and exact settings mutation, then separately verify the executable and arguments before the IDE dispatches a search or MCP server. A gate only around model tool calls cannot be assumed to cover IDE-managed processes or fix inconsistent path normalization.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-04

    The researcher reports the initial path-validation bypass leading to command execution.

  2. 2026-09-16

    According to the disclosure, Microsoft confirms the vulnerability.

  3. 2026-10-13

    The researcher publishes the disclosure and reports that Microsoft is shipping the security fix.

Technical breakdown

  • The protected-filename comparison accepted names ending in a period, while ordinary Windows write APIs normalized them to the protected filenames.
  • In the Visual Studio search chain, injected content induced Copilot to replace the configured ripgrep executable path; a subsequent search launched Calculator.
  • The MCP chain added a malicious server command and changed enablement settings so the IDE launched it. The researcher demonstrated the path in SSMS and reports it also worked in Visual Studio.
  • The researcher identifies a GetFullPath normalization step in the fix; patching and consistent canonical-path checks remain necessary.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Canonicalized agent file-write boundary and independent IDE process-launch boundary
Still needs
PP does not repair Windows path handling, Copilot's validation logic or IDE-side MCP auto-launch behavior. Product fixes remain required. The disclosure reports controlled execution, not secret theft or confirmed exploitation in customer environments.
Receipt required for
Modifying protected Copilot or MCP settings and launching the exact configured executable with its arguments

An external gate could constrain protected configuration writes and subsequent process launches if both boundaries are integrated; this was not tested with PP.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop