Copilot Prompt Trick Triggers VS/SSMS Code Run

How the attack worked

This case centers on CVE-2026-103572, an Important-severity remote code execution issue affecting Visual Studio and SQL Server Management Studio through a shared Copilot component, Microsoft.VisualStudio.Copilot.Core.dll. The researcher found that a Windows path canonicalization quirk, specifically a trailing dot added to a filename like settings.json, allowed Copilot to bypass protections meant to stop it from editing sensitive configuration files. On top of this, path traversal using ..\ sequences let Copilot escape trusted directories, and reading SSMS.isolation.ini exposed an InstallationID that made it possible to reliably locate settings.json.

Why it succeeded

The real danger in this writeup is not just the file-write bypass but how it was triggered. The researcher demonstrated exploitation through indirect prompt injection: untrusted text, framed as an innocent request to explain a file, instructed Copilot to first modify IDE settings before doing anything else. In the demonstrated scenario, Copilot was told to change copilot.general.tools.ripgrepPath to point at calc.exe. Once that setting was in place, a later search action silently launched the attacker-chosen executable instead of the intended tool. This worked because the assistant treated embedded instructions in untrusted content as legitimate commands to follow.

What to watch for

• Instructions embedded in a file, chat, or other content that ask an AI assistant to modify IDE configuration or settings files before completing the user's actual request.
• Settings filenames with unusual characteristics, such as a trailing dot, that may be attempts to bypass filename protections.
• Developer tool settings, like a search or linting tool path, pointed at unexpected Windows executables rather than their normal binaries.
• Multi-step "do this first" instructions appearing in content that has nothing to do with configuration changes.

How to build resistance

Teams using Visual Studio or SSMS should apply vendor patches promptly and treat AI assistant outputs, including tool invocations, as untrusted until verified. Developers and DBAs should be trained to pause when an assistant's response includes steps to alter security-relevant settings, especially when those steps were not part of the original request. Because this kind of content could enter a chat through other channels, including data returned from connected tools or servers, awareness needs to extend beyond obvious phishing-style prompts to any case where an assistant proposes configuration changes. Flagging and blocking unexpected changes that redirect developer tools toward system executables is a practical control that complements user awareness.

What was the core vulnerability in this Copilot flaw?

A Windows path canonicalization quirk involving a trailing dot in a filename let Copilot bypass protected-filename checks and overwrite settings or config files it was meant to be blocked from editing.

How could an attacker exploit this without direct access to the IDE?

The researcher demonstrated exploitation via indirect prompt injection, where untrusted content instructs Copilot to make configuration changes that later result in command execution.

What actually triggered code execution in the demonstrated scenario?

A Visual Studio setting, copilot.general.tools.ripgrepPath, was overwritten to point at calc.exe, so a later search action launched the attacker-chosen binary.

Who should pay attention to this issue?

Developers, DBAs, IT administrators managing Visual Studio or SSMS rollouts, and security awareness teams, since the affected DLL is shared across both tools.