VS Code Added 'Co-Authored-by Copilot' to Commits With AI Off

Key Takeaways

• VS Code added 'Co-Authored-by Copilot' to Git commits even when users had disabled AI features
• Microsoft developer Dmitriy Vasyura acknowledged the error and will revert the default in version 1.119
• The hidden commit tag raised concerns about copyright issues and compliance with corporate AI policies

Microsoft pushed a feature to Visual Studio Code that tagged Git commits as 'Co-Authored-by Copilot.' The problem: it ran even when developers had turned off AI features entirely.

The change slipped through Microsoft's review process with minimal scrutiny. A product manager pushed the code, a principal engineer approved it without a description, and it was merged immediately. No public discussion. No opt-in.

Developers discovered the tag appearing in their commit history and raised alarms on GitHub and Hacker News. The backlash was swift.

Microsoft Admits the Mistake

Dmitriy Vasyura, the Microsoft developer behind the feature, responded to the criticism directly. He acknowledged two separate problems with the implementation.

First, the feature should not have activated for users who disabled AI. Second, commits should not have been labeled as AI-generated when no AI was actually involved in writing them.

“The feature should never have run with AI features disabled, and it shouldn't have tagged commits as AI-generated when no AI was involved.”

— Dmitriy Vasyura, Microsoft developer

Vasyura committed to reverting the default setting in VS Code version 1.119. The fix will ensure the tag only appears when Copilot has genuinely contributed to the code.

Why This Matters Beyond the Bug

Many developers suspect the feature was designed to inflate Copilot's usage statistics. By tagging every commit as AI-assisted, Microsoft could claim broader adoption numbers than reality supports.

The concern is not paranoid. Tech companies track engagement metrics obsessively. A feature that silently attributes human work to AI would produce impressive charts for investor presentations and earnings calls.

But the bigger issue is legal and compliance risk. The 'Co-Authored-by Copilot' tag stayed hidden in the commit window. Developers might not notice it before pushing code to their employers' repositories.

Corporate AI Policies in the Crossfire

Many companies have strict rules about AI-generated code. Some prohibit it entirely. Others require disclosure and review. A few ban it for specific projects involving sensitive data or licensed codebases.

An invisible tag claiming AI co-authorship could trigger policy violations for code that was written entirely by humans. Developers could face internal audits or discipline for commits they thought were clean.

Copyright is another minefield. The legal status of AI-generated code remains unsettled. Some argue it falls outside copyright protection because no human author exists. Others say the human who prompted the AI retains rights.

A false 'Co-Authored-by Copilot' tag could complicate licensing disputes. It creates a paper trail suggesting AI involvement where none existed.

The Discussion Gets Locked

GitHub eventually locked the discussion thread, labeling it as spam. This prevented further comments from developers who wanted to voice concerns or ask questions about the timeline.

The lockdown frustrated some users who felt Microsoft was suppressing legitimate criticism. Others pointed out that popular threads often get locked to prevent brigading and off-topic noise.

Either way, the damage to trust was done. Developers who use VS Code now have reason to audit their recent commits and verify no false AI attribution slipped through.

What to Check in Your Repositories

If you use VS Code and have pushed commits recently, review your Git history for the 'Co-Authored-by: Copilot' trailer. It typically appears at the end of commit messages.

You can search your repository with a simple grep command:

git log --all --grep="Co-Authored-by.*Copilot"

If you find commits with the tag that you wrote without AI assistance, you can amend recent commits or add a note to your repository explaining the false attribution.

For organizations with AI disclosure requirements, a repository-wide audit might be necessary. The tag could have appeared in any commit made with affected VS Code versions before the fix ships in 1.119.

Frequently Asked Questions

How do I check if my VS Code commits have false Copilot attribution?

Run 'git log --all --grep="Co-Authored-by.*Copilot"' in your repository to find any commits with the tag. Review whether Copilot actually contributed to those commits.

When will Microsoft fix the Copilot co-author bug?

Microsoft developer Dmitriy Vasyura said the default setting will be reverted in VS Code version 1.119.

Can false AI attribution affect my code's copyright status?

Potentially. The legal status of AI-generated code is unsettled. A false tag claiming AI co-authorship could complicate licensing disputes or ownership claims.

Why did GitHub lock the discussion about this issue?

GitHub labeled the thread as spam and locked it to prevent further comments. The platform often locks high-traffic threads to manage brigading, though some users felt it suppressed criticism.

Source: The Decoder / Jonathan Kemper