Microsoft’s April 2026 update to Visual Studio Code introduced an unannounced change that automatically appended “Co-authored-by: Copilot” to Git commits for users of GitHub Copilot, provoking a firestorm among developers who said the AI assistant had not meaningfully contributed to their code. The modification, first spotted on April 9, 2026, in VS Code version 1.99.0, affected the built-in Git integration and went live for both Insiders and Stable channel users. Within hours, forums and social media lit up with complaints, many developers calling it an overreach that polluted commit histories and undermined trust in both Copilot and the VS Code platform.

What Actually Changed in VS Code 1.99.0

The root cause was a new default setting in VS Code’s Git extension: git.autoAppendCopilotAttribution. When enabled—and it defaulted to true—any commit created after accepting a Copilot suggestion in the editor would carry an extra trailer line:

Co-authored-by: Copilot <[email protected]>

This occurred even when the developer accepted only a minor inline suggestion, such as a single-line comment or a variable rename. The attribution appeared in the commit message automatically, with no opt-out prompt at commit time. Users who preferred to write their own commit messages in the integrated terminal or via the source control panel were caught off guard, discovering the trailer only after pushing to remote repositories.

The VS Code February 2026 release notes had mentioned a “Copilot attribution” experiment for some Insiders, but many had not anticipated its broad rollout. The change also coincided with a new Copilot feature that suggested entire commit messages—something Microsoft had been testing since late 2025. The auto-trailer behavior seemed to treat any Copilot interaction during a coding session as co-authorship, regardless of how trivial the input.

Developer Community Erupts Over Git Integrity

Reactions were swift and harsh. On GitHub, issue #215439 in the VS Code repository saw over 800 comments in two days. One developer wrote: "My commit history now claims Copilot co-authored a security fix I debugged for three days. That is dishonest and could cause compliance issues." Another contributor from a regulated industry noted that their company’s audit policy considers commit trailers as formal authorship claims; an inaccurate Co-authored-by could violate internal controls.

A Reddit thread on r/programming titled “VS Code is secretly adding Copilot as co-author to my commits” reached the front page, with over 4,200 upvotes. Many users shared screenshots of commit logs showing the unwanted trailer. Some discovered that the trailer persisted even after they had disabled Copilot in the workspace settings, because the git.autoAppendCopilotAttribution setting was separate and had to be turned off manually.

The backlash was not just about surprise. Developers highlighted several concrete problems:

  • Git history pollution: Automated trailers make git log output noisy and crowd out legitimate co-authors.
  • Trust erosion: If commit metadata can be silently altered by an IDE, what else might change without notice?
  • Compliance risks: Many organizations have strict policies about who or what can be listed as a contributor, especially for open-source projects with license agreements.
  • Workflow disruption: Pre-commit hooks and CI systems that parse trailers for changelog generation were suddenly misclassifying Copilot as a human contributor.

A developer with the handle @devopscat tweeted: “I just reviewed three months of commits and found Copilot trailers in 47 of them. I never added them. This is a dark pattern.”

Microsoft’s Response and the Mid-April Patch

On April 11, 2026, a VS Code program manager responded on the GitHub issue, acknowledging that the default should have been false and that the team had underestimated how many users would be affected. The post explained that the feature was intended to give Copilot credit for helping write code, similar to how a human pair programmer would be credited, but that the implementation “left the developer with insufficient control.”

Microsoft released VS Code 1.99.1 on April 14, 2026, which changed the default of git.autoAppendCopilotAttribution to false. The release notes for that patch version included the line: “The Copilot Co-authored-by trailer is now opt-in. Users who want to credit Copilot can enable git.autoAppendCopilotAttribution in their settings.” The update also added a notification bar that appeared if the setting was still true, informing users that Copilot trailers were being appended and providing a one-click option to disable it.

Despite the quick fix, the damage to trust lingered. The VS Code team later published a blog post titled “Earning Trust: How We Handle AI Attribution” which detailed new principles for Copilot features: no silent modifications to user content, clear opt-ins, and preview for any automatic commit changes. The post, however, did not fully placate developers who had already pushed affected commits to public repositories.

How the Attribution Worked Under the Hood

The technical mechanism was straightforward but opaque. The Git extension in VS Code uses a commit-msg hook-like mechanism to modify the commit message before it is finalized. When git.autoAppendCopilotAttribution was true, the extension checked whether any Copilot suggestion had been accepted since the last commit. If yes, it appended the Co-authored-by line if one did not already exist. The check was based on a local session flag, so even closing and reopening VS Code did not reset it until a new commit was made without accepting a suggestion.

Critically, the extension did not differentiate between accepting a single token and accepting an entire function body. In a codebase where a developer occasionally presses Tab to accept a Copilot completion, the trailer was added to the next commit—even if the developer had spent hours writing complex logic entirely by themselves, with Copilot only suggesting something trivial hours earlier.

One engineering manager at a fintech startup told us: “We had a commit that said Co-authored-by: Copilot on a patch for a critical payment bug. Our auditor saw it and asked if we were using AI-generated code in production without review. It took a week to clarify.”

The Larger Context: AI Credit and Developer Autonomy

This incident reflects a broader tension in AI-augmented development: when and how should AI contributions be acknowledged? GitHub’s own documentation on commit trailers has historically treated Co-authored-by as a marker for human co-authors, with the email mapping to a GitHub account. Using a non-human email ([email protected]) subverted that convention. Some developers argued that if Copilot must be credited, it should use a different trailer such as Suggested-by or Generated-with, but not one that implies co-authorship.

Others noted that the move felt like Microsoft trying to boost Copilot’s visibility in public repositories for marketing purposes. The [email protected] email is not associated with a real GitHub user, so projects listing contributors saw a phantom “Copilot” in their insights, potentially skewing contribution graphs.

Open-source maintainers expressed particular concern. A maintainer of a popular Python library said: “I now have to check for inadvertent Copilot trailers in pull requests. If someone submits a patch and VS Code silently adds that line, it could violate our DCO [Developer Certificate of Origin] since the commit message is inaccurate.”

What Users Can Do to Clean Up Affected Repositories

For developers who inadvertently pushed commits with the unwanted trailer, Microsoft recommended using git filter-branch or git rebase to rewrite history, but acknowledged that this is not always possible for shared branches. VS Code 1.99.1 included a new command: “Remove Copilot Trailers from History,” which used an interactive rebase to strip the Co-authored-by lines from the last N commits. However, this only worked for unpushed commits, limiting its usefulness.

To prevent future occurrences, users were advised to:

  1. Update to VS Code 1.99.1 or later.
  2. Check that git.autoAppendCopilotAttribution is set to false in both user and workspace settings.
  3. If using a pre-commit hook, add a script to reject commits containing a Co-authored-by line with [email protected].
  4. For teams, enforce the setting via .vscode/settings.json in the repository.

Some community members created extensions that monitor commit trailers in real time and alert if the Copilot line appears, providing an extra safety net.

Analysis: The Perils of Presumptive Attribution

The VS Code team’s misstep illustrates a classic product design failure: optimizing for a minority use case (wanting to credit Copilot) while alienating the majority who expect their tools to stay out of the way. Had the feature been introduced as an opt-in prompt—“Copilot helped with this commit. Add a Co-authored-by trailer?”—the backlash would likely have been minimal. Instead, the silent default shattered the trust that developers place in their editor to not mess with their source control data.

This is not the first time automated commit modifications have caused friction. Tools like Husky and commitlint have long allowed hooks to adjust messages, but those require explicit setup and are under the project’s control. Here, the default came from the IDE vendor, blurring the line between the developer’s intention and the tool’s behavior.

For Microsoft, the incident is a black eye at a time when Copilot adoption is skyrocketing. Competitors like JetBrains’ AI Assistant and Cursor (an AI-first editor) quickly capitalized on the news, with Cursor’s Twitter account posting: “We will never secretly rewrite your commits. Promise.”

Looking Ahead: What This Means for AI-Assisted Development

The VS Code commit controversy will likely influence how other IDEs and AI coding tools approach attribution. It may accelerate the creation of a standard for AI contribution trailers—perhaps something like AI-Assisted: Copilot that clearly separates human and machine input. GitHub could also introduce a dedicated field in its contribution schema to track AI usage without contaminating the Co-authored-by convention.

More broadly, the incident highlights the need for greater transparency in AI tooling. As the line between human-written and AI-suggested code continues to blur, developers and organizations will demand clear, auditable records. Microsoft has promised a new “Copilot activity log” in VS Code that will show every accepted suggestion and its impact on commits, but as of mid-2026, that feature is still in preview.

For now, the lesson is clear: developers must remain vigilant about defaults, especially in tools that touch version control. A quick check of git log --format='%an %ae%n%(trailers:key=Co-authored-by,valueonly)' can reveal unwanted AI authorship. The VS Code team has taken a step to rebuild trust, but as one GitHub commenter put it, “It’s easier to break trust than to earn it back. This will be remembered.”