Advisoriesby IbisCopilot Chat Security Feature Bypass Vulnerability
VS Code - Security Feature Bypass Vulnerability
A Security Feature Bypass Vulnerability exists in VS Code 1.132.0 and earlier versions where using the Claude agent integration's "Edit automatically" permission mode was able to edit automatically files that were outside of the workspace.
> NOTE: This _only_ impacts the Claude agent integration that is included via the GitHub Copilot Chat extension which ships with VS Code. At the time, the vast majority of customers are already on the Claude agent integration based on [the VS Code Agent Host](https://code.visualstudio.com/docs/agents/concepts/agent-host).
The intent of this permission mode was to allow the Claude agent the ability to make edits to files without needing the user to approve edits. However, editing automatically was only suppose to be done in the workspace(s) that Claude had access to. Instead, in VS Code, the Claude agent would have the ability to edit anything on the user's system. If a user was targeted in a prompt injection attack, that prompt could ask for edits out side of the workspace and the user would not be shown a prompt to approve or deny those edits.
Patches
The fix is available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/commit/8af0773d5ebcbfa2a6ed9f2379a9b69916e79101) mitigates this attack by removing the blanket "allow" for any edit when the user has...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.132.1 | 1.132.1 |
Details and references
## VS Code - Security Feature Bypass Vulnerability A Security Feature Bypass Vulnerability exists in VS Code 1.132.0 and earlier versions where using the Claude agent integration's "Edit automatically" permission mode was able to edit automatically files that were outside of the workspace. > NOTE: This _only_ impacts the Claude agent integration that is included via the GitHub Copilot Chat extension which ships with VS Code. At the time, the vast majority of customers are already on the Claude agent integration based on [the VS Code Agent Host](https://code.visualstudio.com/docs/agents/concepts/agent-host). The intent of this permission mode was to allow the Claude agent the ability to make edits to files without needing the user to approve edits. However, editing automatically was only suppose to be done in the workspace(s) that Claude had access to. Instead, in VS Code, the Claude agent would have the ability to edit anything on the user's system. If a user was targeted in a prompt injection attack, that prompt could ask for edits out side of the workspace and the user would not be shown a prompt to approve or deny those edits. ### Patches The fix is available starting with **VS Code 1.132.1**. The fix (https://github.com/microsoft/vscode/commit/8af0773d5ebcbfa2a6ed9f2379a9b69916e79101) mitigates this attack by removing the blanket "allow" for any edit when the user has the `acceptEdits` permission mode. ### Workarounds Apply these settings to use the Claude Agent via the Agent Host: ``` "chat.agentHost.enabled": true, "chat.editor.claude.preferAgentHost": true, "chat.agents.claude.preferAgentHost": true ``` This will be the only way to use Claude in future versions of VS Code. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/8af0773d5ebcbfa2a6ed9f2379a9b69916e79101 * An issue for this can be found at https://github.com/microsoft/vscode/issues/330312 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65675
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
- Severity from
- GitHub (reviewed advisory)