A Trailing Dot Lets Copilot Rewrite Visual Studio Settings (CVE-2026-103572)

Key Takeaways

• Microsoft patched CVE-2026-103572, a remote code execution flaw in Copilot for Visual Studio and SSMS, on October 13, 2026.
• A trailing dot in a file name slipped past Copilot's check on protected files such as MCP configuration.
• Prompt injection could then make Copilot register a malicious MCP server that runs attacker commands.
• Researcher Johann Rehberger published a proof of concept; no exploitation has been confirmed.

One Character Unlocks the Config File

A single trailing dot let Copilot in Visual Studio overwrite files it was meant to protect. As SecurityOnline reported, the flaw also reached SQL Server Management Studio, which shares the same Copilot code.

What We Know

Johann Rehberger reported the issue to Microsoft on August 4, 2026. Microsoft released the fix on October 13 as part of Patch Tuesday, rating it Important with a CVSS score of 8.8.

Fixed builds are Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4. SSMS is affected through the shared Copilot core library.

The Cloud Security Alliance grouped it with a similar OpenCode flaw as a launch path weakness. Microsoft reports no confirmed exploitation.

What Could Happen

Copilot asks before editing protected files such as .mcp.json or Visual Studio settings. It decided which files were protected by matching the file name.

Windows ignores trailing dots when writing files. A name with a dot at the end passed the check, then Windows stripped the dot and overwrote the real protected file.

An attacker only needed Copilot to read hidden instructions in a repository or other content. The agent could then register a malicious MCP server, which the IDE launched automatically to run any command.

Why It Matters

Visual Studio and SSMS run on developer and database administrator machines that hold source code, credentials, and production access.

The flaw shows that an agent able to edit its own configuration can grant itself new powers. Approval prompts only protect what they correctly recognize.

Organizations should treat MCP configuration as executable code and patch AI coding tools on the same schedule as other critical software.

PointGuard AI Perspective

CVE-2026-103572 turned a prompt injection into code execution by letting an agent rewrite its own launch settings. PointGuard AI helps break that chain.

Agentic endpoint security brings visibility to the coding agents running on developer workstations, so teams can find unpatched Copilot builds and unexpected MCP servers.

PointGuard AI runtime guardrails scan files, retrieved content, and tool outputs for injection patterns before they reach the model, treating repository content as untrusted by default.

The MCP Security Gateway acts as a central enforcement point for MCP connections. Unapproved servers cannot quietly become part of an agent's toolset.

As coding agents gain more autonomy, trustworthy adoption depends on controls that hold even when an agent is manipulated.

Incident Scorecard Details

Total AISSI Score: 5.25/10

Criticality: 7, Developer and database admin machines hold code, credentials, and production access. AISSI weighting: 25%

Propagation: 5, Repository content can carry the injection, but each install is hit separately. AISSI weighting: 20%

Exploitability: 4, Public proof of concept, no confirmed exploitation. AISSI weighting: 15%

Supply Chain: 6, Risk sits in a vendor-supplied AI assistant inside a widely used IDE. AISSI weighting: 15%

Business Impact: 4, Patched with no reported harm, potential exposure only. AISSI weighting: 25%

Sources

Third-Party Sources

• SecurityOnline: CVE-2026-103572 Visual Studio Copilot RCE Disclosed
• Cloud Security Alliance: MCP Launch Paths as RCE

PointGuard AI Sources

• PointGuard AI Agentic Endpoint Security
• PointGuard AI Runtime Guardrails
• PointGuard AI MCP Security Gateway