A critical security vulnerability in GitHub Copilot has been disclosed, allowing attackers to achieve remote code execution and complete system compromise through sophisticated prompt injection techniques.
The vulnerability, tracked as CVE-2025-53773, was patched by Microsoft in the August 2025 Patch Tuesday release following responsible disclosure by security researchers.
Vulnerability Mechanics and Attack Vector
The vulnerability exploits GitHub Copilot’s ability to modify project files without user approval, specifically targeting the .vscode/settings.json configuration file.
By injecting malicious prompts into source code files, web pages, or GitHub issues, attackers can manipulate Copilot into adding the line “chat.tools.autoApprove”: true to the settings file, effectively placing the AI assistant into “YOLO mode”.
| Attribute | Details |
| CVE ID | CVE-2025-53773 |
| Severity | Important (CVSS 7.8/6.8) |
| Impact | Remote Code Execution |
| Vector | Local/Low Complexity/No Privileges Required |
| Weakness | CWE-77: Command Injection |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Once activated, this experimental feature disables all user confirmations for Copilot operations, enabling the AI to execute shell commands, browse the web, and perform other privileged actions without oversight.
The attack chain progresses from initial prompt injection to immediate file modification, followed by unrestricted command execution with full system privileges.
Security researcher demonstrations show the vulnerability successfully compromising Windows, macOS, and Linux systems, with attackers able to target specific operating systems through conditional prompt injection techniques.
The proof-of-concept includes opening calculator applications and establishing remote command-and-control connections, illustrating the severity of potential exploitation.
Beyond basic command execution, researchers identified several sophisticated attack vectors. The vulnerability enables the creation of AI viruses that can propagate through infected repositories, automatically embedding malicious instructions in new projects as developers interact with compromised code.
Attackers demonstrated the ability to recruit developer workstations into botnets, creating “ZombAI” networks of compromised systems.
The attack surface extends beyond the primary YOLO mode exploitation. Researchers discovered additional vulnerabilities involving .vscode/tasks.json manipulation and malicious MCP server injection, all leveraging Copilot’s unrestricted file modification capabilities.
Invisible Unicode-based prompt injections were also demonstrated, though with reduced reliability compared to visible comment-based attacks.
Microsoft confirmed the vulnerability reproduction and implemented fixes in the August 2025 security update. The patch addresses the core issue of unrestricted file modification by requiring user approval for configuration changes that affect security settings.
The vulnerability was initially reported on June 29, 2025, through responsible disclosure channels, with Microsoft acknowledging it as part of an existing tracking initiative.
Security researcher Markus Vervier from Persistent Security independently identified and reported similar findings to Microsoft’s Security Response Center.
This incident highlights the emerging security challenges associated with AI-powered development tools and the need for robust permission models in agent-based systems.
AWS Security Services: 10-Point Executive Checklist - Download for Free
