Microsoft Sneaks Copilot Credit Into VS Code Commits

VS Code 1.118 shipped on April 16, 2026, with a one-line change buried in pull request #310226. That line flipped the git.addAICoAuthor setting from "off" to "all" in extensions/git/package.json. Result: every git commit made from that version forward carries a Co-Authored-by: Copilot <[email protected]> trailer - whether you ever opened the chat panel.

TL;DR

PR #310226 changed one field in VS Code's git extension, defaulting AI co-author tagging to "all" starting with version 1.118
Commits carry the Copilot trailer even on machines where chat.disableAIFeatures is set to true - directly contradicting Microsoft's own release notes
Backlash hit hard: 372 thumbs-down on the PR, 654 comments on Hacker News; Microsoft's developer promised to revert the default in v1.119

What the Change Does

On April 15, 2026, Microsoft engineer cwebster-99 opened PR #310226 against microsoft/vscode:main. The entire functional change was one field in a single file:

// extensions/git/package.json (simplified)

// Before (VS Code 1.117)
"git.addAICoAuthor": {
  "default": "off"
}

// After (VS Code 1.118, PR #310226)
"git.addAICoAuthor": {
  "default": "all"
}

dmitrivMS merged it the next day with 25 of 26 checks passing and no substantive description. With "all" as the default, VS Code's git extension appends the trailer to the commit message after the developer reviews it - right before git commit executes. The tag slips in after the user's last checkpoint.

What "Co-Authored-by" means in Git

The Co-Authored-by trailer was introduced for human collaborators: the engineer who pair-programmed a session with you, or the reviewer who rewrote a function during code review. GitHub parses the trailer and credits both parties in the contribution graph. The Linux kernel project is explicit that AI tools don't qualify for this field - their guidelines require Assisted-by instead.

Attaching Co-Authored-by: Copilot to every commit through a silent default replaced a meaningful provenance signal with editor telemetry. Future auditors - human or automated - now have to discount the trailer before they can trust anything it says.

A tag that shows up late

Multiple developers reported not seeing the trailer until they checked their commit history or noticed the attribution on GitHub's contributor dashboard. The tag isn't visible in the standard VS Code commit input box at the moment you type your message. It appears after.

GitHub Community Discussion #194075: a developer reports that Copilot appended the co-author trailer after they had already deleted the created commit message and replaced it with their own. Source: github.com

What Users Actually Found

Microsoft's release notes stated the trailer would fire only when Copilot made actual changes to a commit. That's not what shipped.

Developers confirmed the trailer attaching to:

Commits made without invoking any Copilot feature
Installs where chat.disableAIFeatures was set to true

Configuration	Documented behavior	Actual behavior in 1.118
Default VS Code 1.118	Trailer on Copilot-assisted commits	Trailer on all commits
`chat.disableAIFeatures: true`	No trailer	Trailer still attached
`git.addAICoAuthor: "off"`	No trailer	No trailer (manual workaround)

The PR drew 372 thumbs-down reactions against two thumbs-up. The GitHub Community Discussion was later locked due to volume. One developer summarized the sentiment: "I didn't even use Copilot for this particular commit, why is it inserting itself into the message?" Another described the behavior as a "random hidden trap" because it didn't attach on every commit consistently, which made it harder to catch.

The thread reached Hacker News on May 2 and hit the front page with 654 comments.

GitHub PR #310226 showing 372 thumbs-down reactions and "No description provided" from the author PR #310226 was merged with "No description provided" and drew 372 thumbs-down reactions once developers noticed the commit behavior changing. Source: github.com

The Gap

A git commit message isn't local state. It travels with every clone, fork, mirror, and archive of a repository. When VS Code began appending Copilot's name without per-commit consent, it started silently editing the permanent provenance record of code at scale - the same problem we've already seen exploited in supply chain attacks targeting Copilot.

The copyright picture compounds the issue. The US Copyright Office has held that non-human entities can't hold copyright, a position reinforced in Thaler v. Perlmutter. Listing Copilot as co-author doesn't transfer rights - but it creates a public attribution that shows up in GitHub's contribution graphs, changelogs, and any downstream legal audit. Some enterprise legal teams have started requiring that AI-produced code stay under 30% of any file to preserve copyright protectability; a blanket automatic trailer makes that accounting impossible.

There's also the signal degradation problem. A Co-Authored-by trailer was supposed to answer a specific question: "who else shaped this commit?" When every commit from every VS Code user carries the tag by default, the answer becomes meaningless. Tools that try to audit actual AI involvement in a codebase now face false positives everywhere.

Cursor, VS Code's closest competitor, handles this differently. It requires developers to review diffs before committing and assigns authorship only to whoever ran git commit. No automatic trailer, no opt-out required.

This is part of a broader pattern. VS Code 1.110 expanded AI integration with browser control and agentic coding features, and Copilot has drawn scrutiny before for training on user data without explicit opt-in. The co-author default is different in character - it doesn't affect your data, it affects your project's public record - but it fits the same pattern of aggressive defaults that place the burden of opting out on the developer.

Verdict

After the backlash on GitHub and Hacker News, Dmitriy Vasyura acknowledged two distinct failures: the feature ran with AI features disabled when it shouldn't have, and it tagged commits as AI-produced when no AI was involved. Microsoft has committed to reverting the "all" default back to "off" in version 1.119.

Until that update arrives, the fix is one line in your VS Code user or workspace settings:

{
  "git.addAICoAuthor": "off"
}

The revert answers the immediate bug. It doesn't answer why a one-line change to commit authorship metadata in a tool with tens of millions of daily users was merged in a day with no description and no community notice.

Sources: