VS Code Silently Stamped “Co-Authored-by: Copilot” on 1.4 Million Human Commits
VS Code Silently Stamped “Co-Authored-by: Copilot” on 1.4 Million Human CommitsA one-line code change. No announcement. No consent. Microsoft just put Copilot’s name on YOUR work — and you couldn’t even see it.
1.4 million commits tagged. 18 days unnoticed. One PR that flipped “off” to “all.” Zero developers asked.
Look, here’s what happened. On April 15, a Microsoft employee pushed a single pull request that changed one setting in VS Code — git.addAICoAuthor — from “off” to “all.” That’s it. One word. And suddenly every git commit you made through VS Code had “Co-authored-by: Copilot” stamped at the bottom. Even if you never touched Copilot. Even if you had it disabled. Even if you manually deleted the line — it came back. And here’s the kicker: VS Code’s commit UI doesn’t show trailer text, so you literally couldn’t see it happening.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Git commit | A save point in your code — like hitting “save” in a video game |
| Co-authored-by | A tag at the end of a save point saying “this person helped write this” |
| Trailer text | Hidden text at the bottom of your commit that most tools don’t show you |
| PR (Pull Request) | A request to merge your code changes into the main project |
| Opt-in vs Opt-out | Opt-in = you choose to turn it on. Opt-out = it’s already on and you have to turn it off |
| Copilot | Microsoft’s AI coding assistant — costs $10-19/month |
📜 How We Got Here
Real talk: this wasn’t some grand conspiracy. A Microsoft dev named Dmitriy Vasyura approved a PR (#310226) on April 15 that shipped in VS Code 1.118. The intent was to support “AI provenance” — basically documenting when AI helps write code.
Problem? The setting defaulted to “all” instead of “off.” And the implementation was broken — it tagged commits even when Copilot was completely disabled. One dev reported on GitHub:
“I deleted Copilot’s generated commit message and manually wrote my own. The final Git history still contained the Copilot co-author line. That is unacceptable in a professional development workflow.”
Microsoft didn’t announce the change. No blog post. No release note flag. No opt-in dialog. Just… silently on.
📊 The Receipts
| Stat | Number |
|---|---|
| Commits affected | ~1.4 million |
| Days before reversal | 18 (April 15 → May 3) |
| PR review time | 1 day (opened April 15, merged April 16) |
| Lines of code changed | 1 (literally flipped “off” to “all”) |
| VS Code monthly users | ~35 million |
| Cost to undo | Impossible without rewriting git history |
That last one is the real problem. These commits are permanent. You can’t just “undo” a commit message without a git rebase — which messes up every branch, every fork, every CI pipeline that touched it. For 1.4 million commits across who knows how many repos, that’s not happening.
⚖️ Why This Actually Matters (Beyond Being Annoying)
Look, this isn’t just Microsoft being sloppy. There are real legal problems here:
- Copyright: In the US, AI-generated content can’t be copyrighted. If your commit says “co-authored by Copilot,” you just gave anyone an argument that your code isn’t fully human-authored. That’s a potential copyright landmine.
- Open source licensing: Some projects (like the Linux kernel) require human sign-off. A Copilot co-author tag could get contributions rejected.
- The Zig project straight up forbids AI-assisted submissions entirely.
- Corporate contracts: Plenty of enterprise agreements specify that code must be human-written. A phantom Copilot tag could violate those terms.
And here’s the part nobody’s saying out loud: Microsoft basically got free advertising on 1.4 million commits. “Co-authored-by: Copilot” sitting in every repo is a billboard that costs them $0 and would’ve cost millions in traditional marketing.
🗣️ What The Timeline's Saying
Developers were NOT having it:
- “This is worse than the Hotmail footer. That was advertising. This is claiming authorship of creative work.”
- “Congratulations Microsoft, you just made every commit from VS Code legally questionable.”
- “So Copilot was trained on OUR code, and now it takes credit for code it didn’t even write? Beautiful.”
Microsoft’s Vasyura apologized: “There was no ill intent by an evil corporation, but rather a desire to support functionality that some customers expect.”
The fix ships in VS Code 1.119, changing the default back to opt-in.
🔍 The Bigger Pattern
This isn’t just a VS Code thing. The whole industry is doing it:
- Claude Code (Anthropic) — adds “Co-Authored-By: Claude” by default
- OpenAI Codex — offers attribution by default since February 2026, but lets you disable it with a config flag
- GitHub itself — already tracks Copilot usage statistics per repo
The play is clear. Every AI company wants provenance tracking baked into the workflow so they can point at numbers and say “look how much code we’re writing.” It’s a metrics land grab disguised as transparency.
Cool. Microsoft Just Put Its Name on Your Code Without Asking… Now What the Hell Do We Do? (╯°□°)╯︵ ┻━┻
🔬 The Commit Auditor
Here’s a play nobody’s running yet. Thousands of companies now have 1.4 million commits with false Copilot attribution baked in. Enterprise compliance teams need those audited. Build a simple script that scans git repos for Co-authored-by: Copilot trailers, cross-references them against actual Copilot API usage logs, and flags the false positives. Package it as a compliance report. Sell it to CTOs who are panicking about their IP portfolio.
Example: A 26-year-old DevOps guy in Tallinn, Estonia builds a Python script using GitPython and the GitHub API. Wraps it in a CLI tool. Posts on r/devops. Three mid-size fintech companies pay him €800 each for repo audits within 2 weeks. Total: €2,400.
Timeline: First client in 5 days (the panic is NOW). Patches out by mid-June, demand drops in 8 weeks as teams clean house.
🪟 The Patch Window Scraper
Every time VS Code pushes a sketchy default, there’s a 2-3 week window where devs frantically search for how to fix it. Right now, “how to disable copilot co-author VS Code” is getting hammered. The SEO window is wide open. Spin up a one-page site with the exact fix ("git.addAICoAuthor": "off" in settings.json), add a VS Code alternatives comparison table, capture emails from frustrated devs, and flip that list to anyone selling dev tools.
Example: A 19-year-old in Nairobi, Kenya deploys a single-page site on Cloudflare Pages (free) with the fix + a “get notified of the next VS Code surprise” email capture. 4,200 signups in 10 days. Sells the email list intro to a JetBrains affiliate program. Earns $1,100 in affiliate commissions.
🕳️ The Provenance Loophole
Real talk: some devs WANT AI attribution removed from their repos — permanently. But git rebase on a shared repo is a nightmare. The play is building a git hook (a small script that runs automatically before every commit) that strips ALL co-author trailers matching AI patterns before the commit goes through. Package it as a pre-commit hook via pre-commit.com. Make it the go-to “AI attribution firewall” for open source projects that ban AI contributions.
Example: A 24-year-old contributor in São Paulo, Brazil writes a 40-line pre-commit hook, publishes it on PyPI, posts it to the Zig community Discord and r/programming. Gets adopted by 3 mid-size open source projects within a week. Leverages the GitHub stars into a $4,500/month contract doing DevOps for a privacy-focused startup that found him through the tool.
📡 The Corporate Snitch Report
Here’s the grey-hat angle. Those 1.4 million false-attribution commits are sitting in public repos RIGHT NOW. You can scrape GitHub for any commit containing “Co-authored-by: Copilot” made between April 15 and May 3, 2026. Cross-reference with the repo’s license (MIT, GPL, Apache). Any project with a “human-authored only” clause just got a compliance violation they don’t even know about. Compile reports per company. Reach out to their legal teams. Charge for the full audit.
Example: A 28-year-old paralegal student in Manila, Philippines uses the GitHub Search API to find affected enterprise repos. Compiles a list of 200 companies with GPL-licensed code carrying false AI attribution. Cold-emails 50 legal departments with a free sample. 4 companies hire her firm for full audits at $2,000 each. Net: $8,000.
🎰 The Trust Score Marketplace
Every time something like this happens, developers trust their tools a little less. The play: build a browser extension that shows a “trust score” for IDE extensions before you install them. Pull data from the extension’s changelog, permission requests, and setting changes per version. Flag anything that changed a default without user consent. Think of it like VirusTotal but for VS Code extensions. First mover takes this niche — nobody’s doing it yet.
Example: A 22-year-old CS student in Kraków, Poland forks the vsce tool to parse extension manifests, builds a scoring algorithm, ships a Chrome + Firefox extension in a weekend hackathon. Gets 8,000 installs in the first month after posting to Hacker News. Monetizes with a $3/month “enterprise dashboard” add-on. Makes €900/month within 6 weeks.
🛠️ Follow-Up Actions
| Want | Do |
|---|---|
| Check if YOUR commits are affected | Run git log --all --grep="Co-authored-by: Copilot" in your repos |
| Disable the setting permanently | Add "git.addAICoAuthor": "off" to your VS Code settings.json |
| Strip AI trailers from future commits | Install a pre-commit hook that filters them out |
| Track the official fix | Watch GitHub Issue #314311 for VS Code 1.119 |
| Switch editors entirely | Check out Zed, Cursor, or Neovim |
Quick Hits
| Want | Do |
|---|---|
 See affected commits |
git log --all --grep="Co-authored-by: Copilot" in terminal |
 Kill the setting now |
Settings → Extensions → Git → “Add AI Co Author” → Off |
 Track the revert |
VS Code Issue #314311 |
 Understand the copyright risk |
US Copyright Office AI guidance |
 Want a clean editor |
Zed Editor — fast, no Copilot drama |
Microsoft trained Copilot on your code, then put Copilot’s name on your code. And they wonder why devs have trust issues.
!