VS Code Quietly Signed 1.4 Million Commits “Co-Authored by Copilot” — Even When It Was OFF
VS Code Quietly Signed 1.4 Million Commits “Co-Authored by Copilot” — Even When It Was OFFYou wrote the code. Microsoft told the world a robot helped. Nobody asked you.
1 dev pushed the change in under 8 hours. No review. ~1.4 MILLION commits got stamped before anyone noticed. Bug ignored the “off” switch entirely.
Okay but seriously — this is the digital version of your coworker photobombing every single one of your family photos and then Microsoft framing them. Here’s the whole dumb saga, plus how the public wreckage becomes free money. The Register broke it down here.
🧩 Dumb Mode Dictionary (read this first, zero shame)
| Nerd Word | What It Actually Means |
|---|---|
| Git commit | A “save point” for code. Every time a dev saves work, it logs WHO did it and when. Public on GitHub. |
| Co-authored-by | A little tag at the bottom of a save that says “this person also helped.” Meant for teammates. |
| Copilot | Microsoft’s AI that writes code for you (like autocomplete on steroids). |
| VS Code | The free app most of the world writes code in. Made by Microsoft. Wildly popular. |
| Trailer | The footer line at the bottom of a commit. The “co-authored-by” bit lives here. |
| Revert | Undo. “We took it back.” |
Translation of the whole story: your save file now had an extra name stapled to it — a robot’s — and you couldn’t see it happening.
🔧 What actually happened (the short, angry version)
- April 15, 2026: One Microsoft dev flips a switch in VS Code so it adds
Co-authored-by: Copilotto the bottom of your commits. Merged and shipped in under 8 hours — no review, no changelog, no heads-up. - The idea sounds fine: if AI helped write the code, credit the AI. Sure.
- The bug: it didn’t check. It stamped Copilot as co-author on every commit — even for people who had Copilot disabled or don’t even use it.
- Because the tag sits at the very bottom and the commit box doesn’t show it, nobody saw it. People found out when they looked at their own git history and went “wait, what the hell is this.”
- Read the receipts straight from the GitHub issue thread (#314311) — devs are not thrilled.
📊 The receipts (numbers that make it worse)
| Thing | Number |
|---|---|
| Time from idea → shipped to millions | < 8 hours |
| Code review before it went out | Zero |
| Commits stamped before the fix | ~1.4 million |
| Commits where Copilot was actually OFF | A LOT of them |
| Date reverted | May 3, 2026 |
| Fixed for real in version | 1.119 |
Source: The Register and heise online.
🗣️ Why devs lost it (it's not just ego)
Honestly, it’s not about who gets the gold star. Three real reasons this stings:
- Copyright: in some places, AI-written code has murky ownership. Stamping “AI helped” on human-only work can quietly muddy who legally owns it.
- Company rules: tons of banks, hospitals, and defense shops ban AI in their code. Their commits just got auto-labeled “AI helped.” That’s an audit nightmare they didn’t cause.
- Trust: a default that lies, silently, on 1.4 million saves? That’s the part people can’t unsee.
Microsoft’s fix going forward: attribution is off by default, never applied to non-AI work, and it now asks first. Full itsfoss writeup here.
💡 The sneaky part nobody's talking about
Every one of those 1.4 million commits is public. Which means: for a few weeks, VS Code accidentally built a giant, searchable list of which companies and people were using AI in their code — visible to anyone who knows how to read a git log.
That’s a signal that’s normally private. And it’s just… sitting on GitHub. Hold that thought. 
Cool. Microsoft Stamped a Robot on Your Homework. Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🕳️ The Ghostwriter Audit
That bugged tag is a public confession. Search GitHub for commits containing Co-authored-by: Copilot inside a company’s public repos, and you’ve got a rough map of who leans on AI and how hard. That’s a signal investors, journalists, and rival hiring managers actually pay for.
Bundle it into a clean one-page “AI-in-their-codebase” snapshot per company. Reverse the data flow: public logs → private insight → niche buyer.
Example: A 24-yr-old data hobbyist in Manila uses GitHub’s free code search + a tiny script to scan 40 public startups, then sells a ranked “who’s quietly all-in on AI” brief to a tech newsletter for a flat finder’s fee per report.
Timeline: First brief sellable in ~1 week. Dries up in 4-6 weeks as the bad tags get scrubbed from history — so move NOW, while the evidence is still in the logs.
🧹 The Commit Scrubber
1.4 million commits got dirty. Loads of solo devs and small shops want those fake Copilot tags gone but have no idea how (rewriting git history scares people — fair, it’s fiddly). Be the person who fixes it in 20 minutes.
The actual tool already exists and it’s free: git-filter-repo. You’re not selling software — you’re selling “I’ll do the scary part so you don’t nuke your repo.”
Example: A 22-yr-old CS student in Lagos posts in a few dev Discords: “Got the phantom Copilot tag? I’ll clean your commit history, safe and reversible.” Charges a small flat rate per repo, does 5 in a weekend from a laptop.
📜 The Human-Made Stamp
As AI floods every codebase, “a real person actually wrote this” becomes a selling point — for legal, licensing, and picky clients. Be first to offer a simple “human-authored, verified” check for a repo: you review the history, confirm no AI-attribution tags, hand over a signed one-pager.
It’s the picks-and-shovels play. Everyone’s arguing about AI code; almost nobody’s selling proof-of-human.
Example: A freelance dev in Kraków adds a “Human-Verified Codebase Report” to their Gumroad as a fixed-price digital service, aimed at small agencies whose clients demand no-AI work for copyright reasons.
🚨 The Compliance Firefighter
Banks, hospitals, and defense contractors that BAN AI just had thousands of commits auto-labeled “AI helped.” To an auditor, that reads like a policy violation — even though Microsoft did it, not them. That’s genuine panic money.
Offer a two-part fix: (1) a scan report showing which commits got falsely tagged, (2) the cleanup. You’re selling peace of mind to people who report to regulators.
Example: A 27-yr-old sysadmin in Bucharest packages a “False-AI-Attribution Sweep” for regulated small firms — scans internal repos for the tag, documents that it was the known VS Code bug, and strips it. Sells the audit trail as the real deliverable.
📖 The Provenance Cheat Sheet
This whole mess just birthed a brand-new confusing topic: AI commit attribution — what the tags mean, when they’re legit, how to remove them, what it does to copyright. There is no single plain-English guide. Be the guide.
Write the definitive free cheat sheet, put it where devs search, and let it become the SEO anchor everyone links to. First comprehensive explainer owns the keyword.
Example: A junior dev in Jakarta writes “The Copilot Co-Author Tag: What It Is and How to Remove It” on a free dev.to blog, links the git-filter-repo fix, and stacks affiliate/newsletter signups from the traffic when the topic trends.
🛠️ Follow-Up Actions
| Move | First Step (do it today) |
|---|---|
| Check your own repos | Search your git log for Co-authored-by: Copilot |
| Clean it | Grab git-filter-repo |
| Update VS Code | Get 1.119+ so attribution asks first |
| Read the drama | GitHub issue #314311 |
| Sell a service | Post the offer in 3 dev Discords tonight |
Quick Hits
| You Want To… | Do This |
|---|---|
 See if you got stamped |
Search your commit history for “Copilot” |
 Remove the fake tags |
Use git-filter-repo |
 Stop it forever |
Update VS Code, keep AI attribution OFF |
 Flip the mess |
Sell scrubbing or compliance audits to panicked teams |
 Own the topic |
Write the plain-English guide before anyone else |
You did the work. Make sure the log still says so — and get paid cleaning up after the ones who forgot.
!