Github Copilot Autoapprove Enabled Followed By Suspicious Child Process

Steve Lon@trust1n

•updated Jan 21, 2026•0•29

Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.