# VS Code Silently Stamped "Co-Authored-by: Copilot" on 1.4 Million Human Commits **URL:** \ **Category:** News & Articles\ **Tags:** programming, hacking, privacy, tips-tricks, news\ **Created:** [May 23, 2026, 1:50pm UTC](https://onehack.st/t/vs-code-silently-stamped-co-authored-by-copilot-on-1-4-million-human-commits/322316 "2026-05-23T13:50:27Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [May 23, 2026, 1:50pm UTC](https://onehack.st/t/vs-code-silently-stamped-co-authored-by-copilot-on-1-4-million-human-commits/322316/1 "2026-05-23T13:50:27Z")
# 🖊 VS Code Silently Stamped “Co-Authored-by: Copilot” on 1.4 Million Human Commits _A one-line code change. No announcement. No consent. Microsoft just put Copilot’s name on YOUR work — and you couldn’t even see it._ **1.4 million commits tagged. 18 days unnoticed. One PR that flipped “off” to “all.” Zero developers asked.** Look, here’s what happened. On April 15, a Microsoft employee pushed [a single pull request](https://github.com/microsoft/vscode/issues/314311) that changed one setting in VS Code — `git.addAICoAuthor` — from “off” to “all.” That’s it. One word. And suddenly every git commit you made through VS Code had “Co-authored-by: Copilot” stamped at the bottom. Even if you never touched Copilot. Even if you had it disabled. Even if you manually deleted the line — it came back. And here’s the kicker: VS Code’s commit UI doesn’t show trailer text, so you literally couldn’t see it happening. * * * > **🧩 Dumb Mode Dictionary** > > | Term | What It Actually Means | > | --- | --- | > | **Git commit** | A save point in your code — like hitting “save” in a video game | > | **Co-authored-by** | A tag at the end of a save point saying “this person helped write this” | > | **Trailer text** | Hidden text at the bottom of your commit that most tools don’t show you | > | **PR (Pull Request)** | A request to merge your code changes into the main project | > | **Opt-in vs Opt-out** | Opt-in = you choose to turn it on. Opt-out = it’s already on and you have to turn it off | > | **Copilot** | Microsoft’s AI coding assistant — costs $10-19/month | > **📜 How We Got Here** > > Real talk: this wasn’t some grand conspiracy. A Microsoft dev named Dmitriy Vasyura approved a PR (#310226) on April 15 that shipped in VS Code 1.118. The intent was to support “AI provenance” — basically documenting when AI helps write code. > > Problem? The setting defaulted to “all” instead of “off.” And the implementation was broken — it tagged commits even when Copilot was completely disabled. One dev [reported on GitHub](https://github.com/microsoft/vscode/issues/314311): > > > _“I deleted Copilot’s generated commit message and manually wrote my own. The final Git history still contained the Copilot co-author line. That is unacceptable in a professional development workflow.”_ > > Microsoft didn’t announce the change. No blog post. No release note flag. No opt-in dialog. Just… silently on. > **📊 The Receipts** > > | Stat | Number | > | --- | --- | > | Commits affected | **~1.4 million** | > | Days before reversal | **18** (April 15 → May 3) | > | PR review time | **1 day** (opened April 15, merged April 16) | > | Lines of code changed | **1** (literally flipped “off” to “all”) | > | VS Code monthly users | **~35 million** | > | Cost to undo | **Impossible** without rewriting git history | > > That last one is the real problem. These commits are permanent. You can’t just “undo” a commit message without a `git rebase` — which messes up every branch, every fork, every CI pipeline that touched it. For 1.4 million commits across who knows how many repos, that’s not happening. > **⚖️ Why This Actually Matters (Beyond Being Annoying)** > > Look, this isn’t just Microsoft being sloppy. There are real legal problems here: > > - **Copyright:** In the US, [AI-generated content can’t be copyrighted](https://en.wikipedia.org/wiki/Artificial_intelligence_and_copyright). If your commit says “co-authored by Copilot,” you just gave anyone an argument that your code isn’t fully human-authored. That’s a potential copyright landmine. > - **Open source licensing:** Some projects (like the [Linux kernel](https://docs.kernel.org/process/submitting-patches.html)) require human sign-off. A Copilot co-author tag could get contributions rejected. > - **The Zig project** straight up forbids AI-assisted submissions entirely. > - **Corporate contracts:** Plenty of enterprise agreements specify that code must be human-written. A phantom Copilot tag could violate those terms. > > And here’s the part nobody’s saying out loud: Microsoft basically got free advertising on 1.4 million commits. “Co-authored-by: Copilot” sitting in every repo is a billboard that costs them $0 and would’ve cost millions in traditional marketing. > **🗣️ What The Timeline's Saying** > > Developers were NOT having it: > > - _“This is worse than the Hotmail footer. That was advertising. This is claiming authorship of creative work.”_ > - _“Congratulations Microsoft, you just made every commit from VS Code legally questionable.”_ > - _“So Copilot was trained on OUR code, and now it takes credit for code it didn’t even write? Beautiful.”_ > > Microsoft’s Vasyura [apologized](https://www.theregister.com/2026/05/04/microsoft_reverses_ai_credit_grab/): _“There was no ill intent by an evil corporation, but rather a desire to support functionality that some customers expect.”_ > > The fix ships in VS Code 1.119, changing the default back to opt-in. > **🔍 The Bigger Pattern** > > This isn’t just a VS Code thing. The whole industry is doing it: > > - **Claude Code** (Anthropic) — adds “Co-Authored-By: Claude” by default > - **OpenAI Codex** — offers attribution by default since February 2026, but lets you disable it with a config flag > - **GitHub itself** — already tracks Copilot usage statistics per repo > > The play is clear. Every AI company wants provenance tracking baked into the workflow so they can point at numbers and say “look how much code we’re writing.” It’s a metrics land grab disguised as transparency. * * * #### Cool. Microsoft Just Put Its Name on Your Code Without Asking… Now What the Hell Do We Do? (╯°□°)╯︵ ┻━┻ > **🔬 The Commit Auditor** > > Here’s a play nobody’s running yet. Thousands of companies now have 1.4 million commits with false Copilot attribution baked in. Enterprise compliance teams need those audited. Build a simple script that scans git repos for `Co-authored-by: Copilot` trailers, cross-references them against actual Copilot API usage logs, and flags the false positives. Package it as a compliance report. Sell it to CTOs who are panicking about their IP portfolio. > > 🧠 _Example:_ A 26-year-old DevOps guy in Tallinn, Estonia builds a Python script using [GitPython](https://gitpython.readthedocs.io/) and the GitHub API. Wraps it in a CLI tool. Posts on [r/devops](https://www.reddit.com/r/devops/). Three mid-size fintech companies pay him €800 each for repo audits within 2 weeks. Total: €2,400. > > > 📈 **Timeline:** First client in 5 days (the panic is NOW). Patches out by mid-June, demand drops in 8 weeks as teams clean house. > **🪟 The Patch Window Scraper** > > Every time VS Code pushes a sketchy default, there’s a 2-3 week window where devs frantically search for how to fix it. Right now, “how to disable copilot co-author VS Code” is getting hammered. The SEO window is wide open. Spin up a one-page site with the exact fix (`"git.addAICoAuthor": "off"` in settings.json), add a [VS Code alternatives comparison table](https://alternativeto.net/software/visual-studio-code/), capture emails from frustrated devs, and flip that list to anyone selling dev tools. > > 🧠 _Example:_ A 19-year-old in Nairobi, Kenya deploys a single-page site on Cloudflare Pages (free) with the fix + a “get notified of the next VS Code surprise” email capture. 4,200 signups in 10 days. Sells the email list intro to a JetBrains affiliate program. Earns $1,100 in affiliate commissions. > > > 📈 **Timeline:** First traffic in 24 hours (search volume peaks NOW). Affiliate money starts in 7 days. Dead in 6 weeks when the next drama cycle hits. > **🕳️ The Provenance Loophole** > > Real talk: some devs WANT AI attribution removed from their repos — permanently. But `git rebase` on a shared repo is a nightmare. The play is building a git hook (a small script that runs automatically before every commit) that strips ALL co-author trailers matching AI patterns before the commit goes through. Package it as a pre-commit hook via [pre-commit.com](https://pre-commit.com/). Make it the go-to “AI attribution firewall” for open source projects that ban AI contributions. > > 🧠 _Example:_ A 24-year-old contributor in São Paulo, Brazil writes a 40-line pre-commit hook, publishes it on [PyPI](https://pypi.org/), posts it to the Zig community Discord and r/programming. Gets adopted by 3 mid-size open source projects within a week. Leverages the GitHub stars into a $4,500/month contract doing DevOps for a privacy-focused startup that found him through the tool. > > > 📈 **Timeline:** First stars in 2 days. Contract offer in 3 weeks. Tool stays relevant as long as AI attribution keeps spreading (so… forever). > **📡 The Corporate Snitch Report** > > Here’s the grey-hat angle. Those 1.4 million false-attribution commits are sitting in public repos RIGHT NOW. You can scrape GitHub for any commit containing “Co-authored-by: Copilot” made between April 15 and May 3, 2026. Cross-reference with the repo’s license (MIT, GPL, Apache). Any project with a “human-authored only” clause just got a compliance violation they don’t even know about. Compile reports per company. Reach out to their legal teams. Charge for the full audit. > > 🧠 _Example:_ A 28-year-old paralegal student in Manila, Philippines uses the [GitHub Search API](https://docs.github.com/en/rest/search) to find affected enterprise repos. Compiles a list of 200 companies with GPL-licensed code carrying false AI attribution. Cold-emails 50 legal departments with a free sample. 4 companies hire her firm for full audits at $2,000 each. Net: $8,000. > > > 📈 **Timeline:** First outreach in 3 days. First paying client in 2 weeks. Window closes in 3 months as companies quietly clean up. > **🎰 The Trust Score Marketplace** > > Every time something like this happens, developers trust their tools a little less. The play: build a browser extension that shows a “trust score” for IDE extensions before you install them. Pull data from the extension’s changelog, permission requests, and setting changes per version. Flag anything that changed a default without user consent. Think of it like [VirusTotal](https://www.virustotal.com/) but for VS Code extensions. First mover takes this niche — nobody’s doing it yet. > > 🧠 _Example:_ A 22-year-old CS student in Kraków, Poland forks the [vsce](https://github.com/microsoft/vscode-vsce) tool to parse extension manifests, builds a scoring algorithm, ships a Chrome + Firefox extension in a weekend hackathon. Gets 8,000 installs in the first month after posting to Hacker News. Monetizes with a $3/month “enterprise dashboard” add-on. Makes €900/month within 6 weeks. > > > 📈 **Timeline:** MVP in 3 days. First installs within a week. Revenue in 6 weeks. Sustainable as long as VS Code extensions keep being sketchy (so… indefinitely). > **🛠️ Follow-Up Actions** > > | Want | Do | > | --- | --- | > | Check if YOUR commits are affected | Run `git log --all --grep="Co-authored-by: Copilot"` in your repos | > | Disable the setting permanently | Add `"git.addAICoAuthor": "off"` to your [VS Code settings.json](https://code.visualstudio.com/docs/editor/settings) | > | Strip AI trailers from future commits | Install a [pre-commit hook](https://pre-commit.com/) that filters them out | > | Track the official fix | Watch [GitHub Issue #314311](https://github.com/microsoft/vscode/issues/314311) for VS Code 1.119 | > | Switch editors entirely | Check out [Zed](https://zed.dev/), [Cursor](https://cursor.sh/), or [Neovim](https://neovim.io/) | * * * **⚡ Quick Hits** | Want | Do | | --- | --- | | 🔍 See affected commits | `git log --all --grep="Co-authored-by: Copilot"` in terminal | | 🛑 Kill the setting now | Settings → Extensions → Git → “Add AI Co Author” → Off | | 📋 Track the revert | [VS Code Issue #314311](https://github.com/microsoft/vscode/issues/314311) | | ⚖ Understand the copyright risk | [US Copyright Office AI guidance](https://en.wikipedia.org/wiki/Artificial_intelligence_and_copyright) | | 🔄 Want a clean editor | [Zed Editor](https://zed.dev/) — fast, no Copilot drama | * * * _Microsoft trained Copilot on your code, then put Copilot’s name on your code. And they wonder why devs have trust issues._