- A researcher found that a trailing dot in a filename let Copilot in Visual Studio and SSMS slip past a protected-file check. Microsoft patched it on October 13.
- It matters because an AI agent that can edit its own settings can be made to run commands. The researcher's post gives no CVE ID.
- Confirm every Visual Studio and SSMS install is updated, and ask vendors how agent restrictions are enforced.
Every guardrail on an AI agent rests on a quiet assumption. The part that checks a request and the part that carries it out must see the same thing. In Visual Studio Copilot, they did not.
What was found
On October 13, Microsoft shipped a fix as part of Patch Tuesday. It rated the issue an Important-severity remote code execution vulnerability. The researcher behind the Embrace The Red blog, who reported it, does not give a CVE ID in the post.
The researcher reported the problem on August 4. The bug let Copilot slip past a path check and write to the files that hold its own settings. With those files changed, Copilot could step outside its limits and run arbitrary commands.
This affects Visual Studio and SQL Server Management Studio (SSMS). SSMS is built on the same code and shell as Visual Studio. The core bug sits in one shared file, Microsoft.VisualStudio.Copilot.Core.dll. The researcher says earlier releases, Visual Studio 2022 among them, are affected too.
How a single dot beats the check
Copilot is not supposed to edit certain protected files. These include the MCP configuration file, .mcp.json. MCP is a standard that lets an AI tool launch helper programs and connect to outside services.
The protection compares the requested filename with a list of protected names. A name written as .mcp.json. (with a dot at the end) does not match the list. The check passes.
Then Windows does what Windows does. Its Win32 layer ignores a trailing dot when the file is written. The write lands on .mcp.json, the very file the check was meant to protect.
The researcher reports a second route. In Visual Studio, a setting in settings.VisualStudio.json names the ripgrep search tool. Overwrite it, using the same dot trick, and Visual Studio launches whatever program you name each time Copilot searches.
From a poisoned file to a running command
The researcher also showed how an outsider could trigger this through indirect prompt injection. That means hiding instructions in content the AI reads. The demo used a file that, once the user interacts with it, hijacks Copilot.
The same content could arrive another way, such as data returned from an MCP server. Once hijacked, the agent edits the MCP file to add a malicious command as a server. The IDE then launches it.
In SSMS, the researcher added path traversal tricks. These let Copilot read a file that revealed an installation ID, which helps locate the settings file. The researcher says this made the attack work across installations.
The idea behind the bug
Think of a mailroom that blocks parcels addressed to Finance but lets through one marked "Finance." The courier delivers both to the same desk. The guard read the label. The courier read the destination.
That is the lesson here. A control on an AI agent is only as good as its match with what the operating system will do. If the check works on text and the action works on files, an attacker needs only a gap between the two.
The researcher's principle is that an agent's limits must stand even if the agent has been hijacked or is simply wrong. The fix fits that. The researcher says that, from inspecting the patch, it appears Microsoft added a call to GetFullPath, which removes the trailing dot and resolves relative path parts.
Limits and open questions
This is one researcher's account, backed by demos. The post does not report attacks in the wild. It also does not include a Microsoft statement.
The researcher says Microsoft judged the issue out of scope for a bounty. They add that this was their third patched, unrewarded vulnerability in two months. They worry researchers may stop reporting to Microsoft first. That is the researcher's view, not a finding.
What leaders should ask this week
First, ask your engineering and data teams whether every Visual Studio and SSMS install has the October 13 update. Include Visual Studio 2022 machines, which the researcher says are affected.
Second, ask where Copilot's agent features and MCP servers are switched on. A file or MCP server response the agent reads can carry hidden instructions, as the researcher's demo showed.
Third, ask your vendors how their agent restrictions are enforced. A rule that checks the name a model typed is weaker than one that checks the final resolved path.
A guardrail that checks the label instead of the destination is not a guardrail. It is a suggestion.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Embrace The Red.
