A trailing dot in a filename bypasses Copilot security, enabling RCE in Visual Studio
wunderwuzzi23 · x · 2026-10-21
Security researcher wunderwuzzi23 disclosed an RCE in Copilot for Visual Studio and SQL Server Management Studio: appending a trailing dot to a config filename bypasses Copilot's security controls. A commenter notes other products with agents doing file IO via win32 fs APIs may share the flaw.
More from Safety
- Center for AI Safety Publishes Full Syllabus for Intro to ML Safety Course — ArtificialOther · 2026-10-21
- Ben Goertzel outlines a general recipe for superintelligence 'basic drives': what it improves vs. protects — bengoertzel · 2026-10-21
- America.gov launches AI portal unifying 29,000 government sites with fraud reporting — soleio · 2026-10-21
- EvilWAF: open-source transport-layer MITM proxy that bypasses modern WAF behavioral detection — godfrey_rono · 2026-10-21
- 2022 interview resurfaced: AI safety researcher says competence, not consciousness, is the risk — davidmanheim · 2026-10-21
- Domingos: GDPR purpose-limitation makes LLM pretraining illegal in Europe — pmddomingos · 2026-10-21