Hijacked by injectionPI-0100
In a researcher demo, injected text made Visual Studio Copilot rewrite its protected settings and run commands
Hidden instructions in a file led Copilot to edit settings files it could not change without the user's confirmation, by adding a trailing dot to the name that Windows drops when saving. With those settings rewritten, the IDE launched a program chosen by the attacker, either as a new tool server or in place of Copilot's search tool; the demo opened the calculator. A security researcher showed the flaw in both Visual Studio and SQL Server Management Studio and reported it in August. Microsoft rated it an important remote code execution flaw and fixed it as CVE-2026-103572.
Harm: No harm reportedControl level 3, Exceeded permissions
Not counted · can set the control floorEffect on the index
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
2 sources · single source. Links go to the original publishers; the summary above is in our own words.
- primaryCVE-2026-103572: Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution VulnerabilityMicrosoft Security Response Center · Oct. 13, 2026msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572
- researchVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Embrace The Red · Oct. 13, 2026embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
Why this rating
No harm reported; control failure level 3
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm reportedThe researcher demonstrated arbitrary command execution in Visual Studio and SSMS on test setups. No exploitation or harm to real users is reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Exceeded permissionsFollowed injected instructions and wrote to protected settings files using a filename trick the attacker supplied, which skipped the user-confirmation check.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
This was a researcher's controlled demonstration, and the flaw is not reported as exploited, so no harm is recorded. That is not a finding of safety. Control sits at level 3: the hijacked agent wrote to protected settings files that should have needed the user's confirmation, using a filename trick that came from the attacker's text, and it reached nothing beyond the test machine. Microsoft confirmed the flaw, rated it an important remote code execution issue and fixed it as CVE-2026-103572.
Effect on the index
Not yet in a weekly reading
Not counted: no harm reported.
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 16, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “In a researcher demo, injected text made Visual Studio Copilot rewrite its protected settings and run commands.” Record PI-0100. Reported Oct. 13, 2026; updated Oct. 16, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0100