Microsoft's September 2026 security release on 8 September fixed a group of Visual Studio Code bugs in version 1.136.2, and several of them target the AI agent. CVE-2026-81380 could cause GitHub Copilot agent mode to send workspace data and environment variables to an attacker-controlled service. CVE-2026-81381 could expose a sign-in access token for a user's work account, and four more CVEs let content processed by the VS Code agent bypass the network restrictions meant to keep it from reaching blocked resources.
What's affected
All of the following are fixed in Visual Studio Code 1.136.2. Microsoft lists none as publicly disclosed or exploited.
Copilot and VS Code information disclosure
- CVE-2026-81380 (CVSS 5.3, CWE-77). Microsoft's FAQ: exploitation "could allow an attacker to obtain sensitive information from the user's development environment, including workspace data and environment variables, by causing GitHub Copilot agent mode to send that information to an attacker-controlled service." Attack complexity is rated high. Credited to Gustavo Uhlein.
- CVE-2026-81381 (CVSS 6.5, CWE-522, insufficiently protected credentials). This "could expose a sign-in access token for a user's work account," which could then allow access to data and services the user is authorized to use. Credited to Sebastien Morin.
Agent network restriction bypasses
- CVE-2026-81356, CVE-2026-81357, CVE-2026-81378 and CVE-2026-81379 (CVSS 8.2 each). For all four, Microsoft says an attacker "could influence content processed by the Visual Studio Code agent so that it requests a specially crafted URL," bypassing "the network access restrictions enforced for the Visual Studio Code agent." User interaction is required to run the agent against attacker-controlled content.
Workspace Trust bypasses in the same release
- CVE-2026-81376 (CVSS 9.6) and CVE-2026-78462 (CVSS 8.8): a crafted workspace could make VS Code connect to an attacker-controlled service and bypass Workspace Trust, leading to local data access or code execution.
- CVE-2026-70334 (7.8) and CVE-2026-78461 (7.4): other ways for untrusted workspace content to run commands or code without trust being granted.
The release also included CVE-2026-81377 (tampering, 6.5) and CVE-2026-81383 (information disclosure, 7.4). VS Code 1.136 shipped on 2 September; 1.136.2 is the security update.
How to check if you're exposed
Check each machine's VS Code version:
code --version | head -1
Anything older than 1.136.2 is exposed to all of the above. Most installs auto-update, so focus on the exceptions: pinned versions in VDI images, dev containers, remote servers and offline machines.
ls ~/.vscode-server/bin/ 2>/dev/null
Then look at where Copilot agent mode runs against content you don't control. The two leak paths, CVE-2026-81380 and the network bypasses, both start with the agent reading attacker-supplied text: issues, pull requests from forks, dependency source, fetched web pages.
Finally, check what the agent could have sent. Environment variables are named in CVE-2026-81380, so list what a VS Code session inherits:
env | cut -d= -f1 | grep -iE 'token|secret|key|password|credential' | sort
What to do now
- Update VS Code to 1.136.2 or later. If you've already moved to 1.141.1 for the October fixes, you're covered.
- Keep long-lived secrets out of the editor's environment. If a cloud key or registry token sits in your shell profile, every agent session can read it. Load secrets per command or per task instead.
- Rotate exposed secrets where the risk was real. If developers ran Copilot agent mode on untrusted content before updating, rotate the high-value tokens that were in their environment.
- Don't treat agent network restrictions as the only control. Four bypasses landed in one release. Pair them with egress controls at the network or proxy level for machines where the agent runs on sensitive code.
- Review sign-in token handling for CVE-2026-81381 with your identity team. If you saw unusual activity from developers' work accounts, revoke sessions for those accounts.
- Keep Workspace Trust on and open unfamiliar repositories in Restricted Mode.
Why it matters
Agent mode combines three things: access to a developer's files and environment, the ability to make network requests, and instructions taken from text it reads. Prompt injection uses the third to abuse the first two. CVE-2026-81380 is that chain in a single CVE.
Network restrictions are the obvious defense, which is why four separate bypasses in one month matter. Each one is a different way of shaping a URL so the policy check sees something harmless. Allowlists on URLs fail in the same ways allowlists on shell commands do: the checker and the thing doing the work parse input differently.
The durable fix is to limit what's worth stealing. An agent session with no long-lived secrets in reach has much less to leak, whatever the next bypass looks like.
Try it yourself
Run the env filter above in the terminal you use for VS Code and count the credentials an agent session would inherit. Pick the riskiest one and move it to a per-command secret store. Then see how vulnerability management tracks fixes like 1.136.2 across a fleet.
Click through it at your own pace, or open it full screen.
Quick check
What could CVE-2026-81380 leak?
Microsoft says workspace data and environment variables from the developer's environment, sent by Copilot agent mode to an attacker-controlled service.
Do the network bypasses need the user to do anything?
Yes. Microsoft says user interaction is required to run the agent against attacker-controlled content. In practice, that is asking the agent to work on a file, issue or page the attacker wrote.
Which version fixes these?
Visual Studio Code 1.136.2. Later releases, including 1.141.1 from October, include the fixes.
