Security researcher Johann Rehberger disclosed on October 13 that a single trailing dot in a filename let GitHub Copilot in Visual Studio and SQL Server Management Studio bypass a guardrail meant to stop the agent rewriting its own protected configuration files without user confirmation. The check compared the requested path to protected names such as .mcp.json as plain strings; on Windows, a filename ending in a period is saved without that character, so a name like settings.VisualStudio.json. matched neither blocked name and was then written to the real protected file.

With those files writable, a steered or prompt-injected Copilot could register a malicious MCP server that the IDE launches automatically, or point the copilot ripgrepPath setting at an attacker binary that Visual Studio runs on every text search. Microsoft rated the flaw, CVE-2026-103572, as Important remote code execution at CVSS 8.8, confirmed it on September 16, and shipped the fix in the October 13 Patch Tuesday updates — normalising the path with GetFullPath before the check. Developers should update Visual Studio 2022 to 17.14.42 or later, or Visual Studio 2026 to 18.10.4 or later, and update SSMS in the same pass.

Rehberger reported the flaw on August 4 and noted Microsoft classed it out of scope for a bug bounty despite the severity rating and shipped fix — his third Copilot vulnerability in two months, he said, to be patched without a reward. The pattern is the wider story: the bug was a classic pre-AI path-validation mistake, but what it unlocked was an agent's ability to reconfigure its own tools.