Johann Rehberger (Embrace The Red) reports that a file-path check meant to stop Copilot in Visual Studio and SQL Server Management Studio from writing to its own protected configuration could be bypassed, letting the agent change its settings, escape its containment restrictions and run arbitrary commands. He says he also showed that a third party could trigger this through indirect prompt injection. Microsoft classified the issue Important (remote code execution) and, the post says, shipped the fix on 2026-10-13. He says he found it while validating fixes for earlier SQL Copilot security issues; these are the researcher's claims, not a Microsoft advisory.
It is a researcher's account of an agent's protections around its own configuration failing, which turned a prompt injection into code execution on the developer's machine and shows a containment limit that depended on one file-path check.
Key facts
As stated in the sources, with where to find them.
- The post's text, as retrieved, has no date line; 2026-10-13 is the publication date in the site's RSS feed and matches the post saying that Microsoft shipped the patch that day. The post says Microsoft classified the issue as an Important-severity remote code execution vulnerability with a CVSS score of 8.8 and that the fix shipped as part of Patch Tuesday on 2026-10-13. The CVE record at Microsoft's update guide is linked from the post but was not reviewed for this record, so severity, score, affected versions and fix details are as the researcher states them.Opening; Disclosure and Patch Timeline; site feed
- Class of flaw, as the researcher describes it: a check intended to stop the agent from modifying its own settings and configuration could be bypassed through a difference in how the operating system interprets file paths, which let the agent write to protected files and escape its containment restrictions to reach arbitrary command execution. The post reports a shared vulnerable component in both Visual Studio and SSMS, says older versions including Visual Studio 2022 are affected, and says other weaknesses in the same path handling existed. This record omits the specifics.Opening; The Root Cause; Other Bypasses and Observations
- Attack path, as the researcher reports it: a misaligned or hijacked agent could use the bypass to change its own tool configuration and have the IDE run an attacker-chosen command, and he says his report to Microsoft demonstrated that a third party could trigger this through indirect prompt injection. He shows demonstrations for Visual Studio 2026, using a Microsoft model (MAI-Code-1-Flash) that he says seems to have poor indirect prompt injection resilience, and for SSMS; that is an observation from his demonstrations, not a measured evaluation.Attack Chains and Exploit Demos; Exploit Demo for VS; Other Bypasses and Observations
- Disclosure timeline from the post: reported 2026-08-04; broader Visual Studio implications shared 2026-08-04 to 2026-08-07; follow-up 2026-08-30; Microsoft confirmed the vulnerability 2026-09-16; a $0 bounty awarded 2026-10-11 on the basis, he says, that it was out of scope for a bounty; fix shipped 2026-10-13. He criticizes the lack of a reward and says this was his third patched vulnerability in two months without one; Microsoft's account is not given.Disclosure and Patch Timeline
- Fix and relation to the earlier record: the researcher says he found this while validating fixes for SQL Copilot security issues; the earlier issues are recorded separately in embrace-the-red-sql-copilot-ssms-cve-2026-65669-2026. He says he examined the fix and that it normalizes the file path before the check, which he expects to address the bypass and some related variants; this is his reading, not a Microsoft statement.Disclosure and Patch Timeline; Analyzing the Fix; References
- The researcher's takeaway: security controls around agents must hold even when the agent itself is compromised or misaligned, and he expects more such cases as AI speeds up finding file-system and path-handling bugs. He urges readers to patch their Visual Studio and SSMS installations.Conclusion
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.