Microsoft caught sneaking "Co-Authored-by Copilot" into VS Code commits - even with AI off

2026-05-03 · Source: The Decoder · Field: Technology & Digital — Software Development & Engineering, Artificial Intelligence & Machine Learning · Depth: Intermediate, quick

Summary

Microsoft recently integrated a "Co-Authored-by Copilot" line into Git commits within Visual Studio Code, even for users who had explicitly disabled all AI features. This change was pushed by a Microsoft product manager and merged without clear description, leading to significant backlash on GitHub and Hacker News. Dmitriy Vasyura, a Microsoft developer, acknowledged the error, stating the feature should not have activated with AI disabled nor tagged commits as AI-generated when no AI was involved. He committed to reverting the default setting in version 1.119. The incident raised user suspicions about Microsoft inflating Copilot usage metrics and concerns regarding potential copyright issues or non-compliance for companies with strict AI policies, especially since the line remained hidden in the commit window.

Key takeaway

For engineering leaders overseeing development workflows, you should immediately audit your team's Git commit metadata for any unauthorized or unexpected AI attribution, particularly within Visual Studio Code. This incident highlights the critical need to ensure development tools respect user-configured AI settings to avoid potential copyright disputes, compliance violations, or erosion of developer trust.

Key insights

Undisclosed AI attribution in code commits can lead to significant user distrust and policy conflicts.

Principles

• Transparency is crucial for AI feature integration.
• User settings must be respected for AI functionality.

In practice

• Audit commit metadata for unexpected AI attributions.
• Verify AI feature settings are honored by tools.

Topics

• Visual Studio Code
• GitHub Copilot
• Git Commits
• AI Feature Control
• Copyright Implications

Code references

• microsoft/vscode

Best for: CTO, VP of Engineering/Data, Director of AI/ML, Software Engineer, AI Engineer, Tech Journalist

Related on AIssential

• Microsoft fixes VS Code after app gives Copilot credit for human's work — Default AI attribution in code commits sparked developer backlash and raised complex IP and liability questions.
• Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) — AI assistants with private data, untrusted content, and external communication form a "lethal trifecta" for data exfiltration.
• How Relay Network Adopted AI Coding Securely and Built the Foundation for Agentic Development — Embedding security "secure at inception" into AI-assisted development prevents vulnerabilities and accelerates remediation.
• 😺 OpenAI leaked GPT-5.4 three times — OpenAI's GPT-5.4 is leaking while AI-driven "Vibe coding" gains traction despite significant security risks.
• GitHub Just Made a Big AI Coding Move — The new GitHub Copilot app offers model provider choice, unlike Codex, but sign-ups are currently paused.
• Code Is Not Cheap: How to Multiply Your AI’s Output With Software Fundamentals — AI-assisted coding, while prevalent, demands human engineering expertise to mitigate quality issues from "jagged" model outputs.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Decoder.