Security researcher Embrace The Red said on 13 October that Microsoft patched a Copilot flaw in Visual Studio and SQL Server Management Studio (SSMS). The researcher says Microsoft rated it Important, with a CVSS score of 8.8. Copilot checked file names against a list of protected files, such as .mcp.json, which can start programs. The name ".mcp.json." with a trailing dot did not match as text. Windows dropped the dot when saving, so the write hit the protected file. That let Copilot edit its own settings and run commands. The researcher also showed that hidden instructions in content the AI reads could set this off.
The researcher says Microsoft confirmed the bug on 16 September and shipped the fix on 13 October. The researcher's reading is that the fix cleans each path first, so the check and Windows see the same name. Microsoft's own account of the fix is not in the sources. They also do not say whether attackers used the flaw.
The researcher's point is that limits on an AI agent must hold even if the agent is hijacked. Here, one name check was the limit. Leaders can ask which files their coding agents can write, whether those files can launch programs, and whether the guard survives hidden instructions.