Copilot Custom Agent Hook Remote Code Execution Vulnerability

Impact

A remote code execution vulnerability exists in VS Code 1.132.0 and earlier versions where a crafted prompt injection can cause the Copilot agent to write custom agent files containing lifecycle hooks without presenting a confirmation to the user. When the custom agent is invoked, these hooks can execute attacker-controlled shell commands with the privileges of the user running VS Code.

Patches

The fix is available starting with VS Code 1.132.1. The fix ([4224780](https://github.com/microsoft/vscode/commit/4224780376b700ba06c8f98442abbb971e596a88)) mitigates this attack by requiring confirmation before editing agent and hook configuration files that can register lifecycle shell commands.

Workarounds

Avoid including untrusted data in Copilot prompts. Do not use Copilot Agent mode with untrusted workspaces, files, or instructions on versions of VS Code <=1.132.0.

References

• The patch for this can be found at [4224780](https://github.com/microsoft/vscode/commit/4224780376b700ba06c8f98442abbb971e596a88)
• An issue for this can be found at [#330322](https://github.com/microsoft/vscode/issues/330322)
• MSRC details for this can be found at [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335)