VS Code Was Quietly Tagging Your Commits as Copilot-Assisted — Even With AI Off
Agentic AIMicrosoft shipped VS Code 1.118 on April 29, 2026 with a feature that quietly inserted Co-Authored-by: GitHub Copilot into git commits — even for developers who had explicitly disabled AI features.
The change was discovered through GitHub’s public review process, where community members identified that Copilot attribution was appearing in commit metadata regardless of whether any AI assistance had actually been used. Discussion spread quickly to Hacker News, where developers flagged two distinct concerns: one practical, one legal.
Context
VS Code’s 1.118 release introduced git AI co-authoring as an opt-out default. A product manager initiated the change; a principal engineer approved it without detailed documentation before it was merged. The Co-Authored-by: Copilot line appeared hidden in the commit window metadata — not visible in the standard commit message display — which is precisely why it went unnoticed until external review surfaced it.
This matters in two ways. Enterprises often maintain explicit AI usage policies, frequently tied to legal review of AI-generated intellectual property. A hidden attribution tag in commit history could constitute undisclosed AI involvement in codebases where such disclosure is contractually required. Developers operating under client agreements or in regulated industries are particularly exposed.
The Detail
The copyright dimension is the sharper edge. The U.S. Copyright Office has consistently ruled that non-human authors cannot hold copyright — most recently reaffirmed in the Thaler v. Perlmutter decision. If Copilot appears as a co-author on a commit, it introduces ambiguity about the copyright status of that code. That ambiguity is not theoretical; it is the kind of thing due-diligence reviews and M&A audits will eventually surface.
The secondary concern is metric manipulation. Multiple commenters on Hacker News noted that inserting Copilot attribution on commits where no AI was involved would inflate Copilot usage statistics — creating a false signal that the tool is more widely used than it actually is. Microsoft did not address this interpretation directly.
Microsoft developer Dmitriy Vasyura acknowledged the implementation error publicly, stating the feature should never have activated when AI settings were disabled and should not have tagged commits as AI-generated in the absence of actual AI usage. He committed to reverting the default behavior in VS Code version 1.119.
The So What
The immediate remediation is clear: development teams running VS Code with Copilot installed should audit commit history from April 29 onward for unexpected Co-Authored-by: Copilot entries. The git -c user.email settings cannot remove already-merged metadata, but teams can document the occurrence and push corrected commits where legal requirements demand it.
The broader implication is less about this specific incident and more about a pattern now visible across AI tooling: features that redefine consent boundaries are shipping as opt-out rather than opt-in. Agentic systems increasingly blur the line between assistance and authorship, and the governance frameworks most organizations have in place were not written for tools that can add their signature to your work without being asked.
Enterprises with AI policies — especially those containing clauses about disclosure, IP ownership, or prohibited AI usage — should treat VS Code upgrades as compliance events, not just productivity updates.
Photo by RealToughCandy.com on Pexels
Source: The Decoder
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →