Microsoft Forced 1.119 After Copilot Claimed the Wrong Commits
VS Code issue 314311 shows how one default turned attribution into audit evidence, then forced 1.119 back to explicit consent.
Commit Custody
Microsoft Forced 1.119 After Copilot Claimed the Wrong Commits
VS Code issue 314311 shows how one default turned attribution into audit evidence, then forced 1.119 back to explicit consent.
Microsoft Forced 1.119 After Copilot Claimed the Wrong Commits. Image created by the author with diffusion-synthesis and Python post-processing.
Microsoft took a commit footer most teams barely notice and moved it into the risk column for founders and engineering leaders deciding whether to approve AI editors. In a regulated repo, that footer is not just a messy suggestion or an awkward credit line, but audit exposure written into the public Git record.
The object is small enough to miss in review: Co-authored-by: Copilot. In VS Code pull request 310226, merged on April 16, 2026, Microsoft changed git.addAICoAuthor from off to all by default. In VS Code issue 314311, opened on May 5, Microsoft said the 1.117 rollout began April 22, that a bug attributed non-Copilot completions to Copilot, and that the footer could appear even when AI features were disabled.
The robot signed the guestbook.
The Footer Became Evidence
A commit footer sounds harmless until a buyer, auditor, open-source maintainer, or investor reads it as provenance. GitHub’s own docs say a Co-authored-by trailer attributes a commit to more than one author, and those co-authored commits are visible on GitHub. That makes the footer stronger than a tooltip.
It travels with the commit message.
That is the pressure point. The issue is not whether Copilot writes useful code. The issue is whether your tool can change the record of who did the work after your team already made a policy promise, signed a customer clause, or told an investor how engineering uses AI.
Bad code breaks builds. Bad metadata breaks trust.
For a startup selling into healthcare, finance, defense, education, or enterprise security, the footer is not just a developer annoyance. It can become a screenshot in a diligence folder. It can sit inside a mirrored repo.
It can get pasted into a Slack thread by a reviewer asking why the company’s “no AI-generated code in this module” rule has a Copilot footprint.
The dangerous part is the mismatch. A developer can write the code by hand, inspect the diff, commit through the VS Code interface, and still leave behind a line that says Copilot co-authored the change. The tool didn’t merely assist; the record says it helped author.
The Default Did The Damage
Figure 2. Proof of operating detail: The cited source, visible on GitHub, gives the article the implementation surface teams must design around. Source: GitHub
The mechanism was not mystical. It was a setting.
Microsoft’s issue timeline says VS Code 1.110 introduced git.addAICoAuthor with three values: off, chatAndAgent, and all. The default started as off. In 1.117, public rollout began April 22, 2026, and the default changed to all.
That meant attribution could be added when a commit contained AI-generated code from chat, inline completions, or next edit suggestions.
Then the bug made the line worse than the policy. Microsoft wrote that non-Copilot code completions were attributed to Copilot, including cases where disableAIfeatures was turned on. In plain English: the “AI is off” path could still leave AI authorship metadata behind.
That is why this belongs on a leadership checklist, not just a developer forum. Tool defaults create incentives. Vendors benefit when AI assistance becomes visible in product surfaces because visible usage is easier to justify, market, and measure.
Developers carry the downside when that visible trace is wrong.
The payoff is asymmetric. The editor gains a proof point. The developer gains an explanation burden.
A single commit footer can force a team into the most irritating kind of meeting: the one where nobody debates the code because everyone is explaining the artifact around the code. Was Copilot used? Was it allowed?
Did the engineer disable it? Was the customer told? Did the repo policy catch it?
Why does the evidence disagree with the person who did the work?
That meeting costs more than the saved keystrokes.
The Revert Proved The Stakes
Microsoft’s reversal matters because it confirms the real control surface. In pull request 313931, merged on May 3, 2026, VS Code changed the default back to off, made sure contribution tracking is disabled when AI features are disabled, and skipped the trailer when chat.disableAIFeatures is enabled. Issue 314311 said those fixes would be tested and released in 1.119, with public rollout starting May 6.
The better promise came in the same issue: before adding a commit trailer, the user would need to give consent, no matter the default value. That is the line every founder should copy into their own rollout policy. Metadata that can affect authorship, compliance, or customer interpretation must be explicit.
Silent attribution is not transparency. It is surprise paperwork.
The Linux kernel community offers a sharper model. Its AI Coding Assistants guidance says AI agents must not add Signed-off-by tags because only humans can certify the Developer Certificate of Origin. When AI tools contribute, the kernel docs point to an Assisted-by tag with the agent name, model version, and optional tools.
The patch submission guide also says advanced coding tool use needs that tag.
That distinction is the whole lesson. “Co-authored” says authorship. “Assisted” says help.
One rewrites the cast list. The other records the tool on the bench.
Leaders don’t need a grand theory of AI purity here. They need a clean boundary between authorship, assistance, and editor convenience. When those three collapse into one footer, the team loses the ability to explain itself without sounding evasive.
What To Block Before Rollout
Figure 3. Proof of operating detail: The cited source, AI Coding Assistants, gives the article the implementation surface teams must design around. Source: Kernel
The fix starts with a boring inspection that deserves executive attention because the downside lands above the repo. Open the editor settings your team actually ships with, not the clean defaults in a demo. Search for git.addAICoAuthor.
Check the user settings, remote container settings, devcontainer templates, workspace settings, and policy-managed profiles. Then test the disabled-AI path by committing a trivial change and reading the raw commit message before it touches a shared branch.
Do the same for Cursor, Codex, Copilot, and any other AI editor that can write commit messages, patch descriptions, pull request summaries, or provenance metadata. The risk is not tied to one brand. VS Code gave the market a visible failure case.
A practical rollout rule can fit on one page:
-
Any AI authorship or assistance metadata must be opt-in, visible before commit, and consistent with company policy.
-
Disabled AI features must disable AI contribution tracking, not merely hide chat panels.
-
Repos with customer, investor, open-source, or regulatory scrutiny should reject unapproved trailers in pre-commit hooks or CI.
-
Approved metadata should distinguish author, assistant, reviewer, and tool. Those roles are not interchangeable.
-
Engineers need a simple way to inspect and remove wrong metadata before push, without asking security for a ceremony.
The last item matters. If correction feels like confession, people will route around the rule. That is the game-theory trap.
A punitive policy makes hidden cleanup rational. A clear, fast correction path makes truthful records cheaper than evasive ones.
The historical pattern is familiar. Software teams first treated logs as technical exhaust, then learned logs become legal evidence, breach timelines, billing records, and postmortem ammunition. AI editor traces are entering the same phase.
What looked like convenience now sits in the chain of custody.
That does not mean banning AI editors. It means treating their metadata as production output. Review it.
Version it. Test it. Block it when it lies.
The Commit Line Is The Decision
The May 2026 VS Code reversal should change one approval question. Do not ask only whether the generated code is good enough. Ask whether the editor can make truthful human work look unauthorized.
That question reaches past VS Code. It belongs in procurement. It belongs in engineering enablement.
It belongs in customer security answers. It belongs anywhere a company says, “Here is how our people use AI,” and then hands over a repo that tells a different story.
A footer is small enough to miss and durable enough to matter. Thank you for reading, and do not ship an editor that can make honest work look unauthorized.
Figure 4. Proof of operating detail: The cited source, patch submission guide, gives the article the implementation surface teams must design around. Source: Kernel
A parallel version of the same pressure shows up in GitHub Copilot Just Put a Meter on Your Best Models.
Related reading
메타데이터
- post_id
- d92dc00a97f9
- slug
- microsoft-forced-1-119-after-copilot-claimed-the-wrong-commits-d92dc00a97f9
- url
- https://medium.com/kairi-ai/microsoft-forced-1-119-after-copilot-claimed-the-wrong-commits-d92dc00a97f9
- canonical_url
- https://medium.com/kairi-ai/microsoft-forced-1-119-after-copilot-claimed-the-wrong-commits-d92dc00a97f9
- author_url
- https://medium.com/@james.kuhman
- status
- ok
- fetched_at
- 2026-07-09 08:02:55
