---
title: VS Code CVE-2026-102232: prompt injection could let the Copilot agent edit lifecycle-hook files without confirmation | ctxsec
url: https://ctxsec.com/items/vscode-cve-2026-102232-agent-hooks
description: ""
status: "confirmed (MSRC); not exploited"
published: 2026-10-13
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/vscode-cve-2026-102232-agent-hooks.md)

confirmed (MSRC); not exploited

2026-10-13

### VS Code CVE-2026-102232: prompt injection could let the Copilot agent edit lifecycle-hook files without confirmation

MSRC's October release fixes **CVE-2026-102232**, a Visual Studio Code security feature bypass (Important, CVSS 7.0, CWE-863). Per Microsoft's FAQ, crafted content processed by the AI coding agent could **modify a configured lifecycle-hook file without the expected confirmation**, leading to commands running as the user. The chain requires prompt injection, Copilot agent interaction and then a build trigger (AC:H, UI:R). It is fixed in **VS Code 1.141.1** (released Oct 13); versions 1.0.0 through 1.141.0 are affected. Microsoft marks it not publicly disclosed and not exploited. This is the second hook-file bypass this year: GHSA-w79w-rj9h-vg4f / CVE-2026-70335 (fixed in 1.132.1, August) added confirmation before agents write custom-agent hook configs. Treat agent-writable config (hooks, MCP and agent definitions in `.github/` and `~/.copilot/`) as code. Review diffs to those paths, and don't run agent mode on untrusted repos with pre-1.141.1 builds.

Sources: [MSRC CVE-2026-102232](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102232) · [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-102232) · [Earlier advisory GHSA-w79w-rj9h-vg4f](https://github.com/microsoft/vscode/security/advisories/GHSA-w79w-rj9h-vg4f)