VS Code Copilot co-author default now adds artificial intelligence as a named contributor to your git commits automatically, without your permission or knowledge. Microsoft’s April 29, 2026 release of VS Code version 1.118 introduced this behavior, tagging commits with “Co-authored-by: Copilot <[email protected]>” for any AI assistance—including trivial changes like fixing typos or adding commas. The move has ignited immediate backlash over job security, copyright validity, and the integrity of development history.
Key Takeaways
- VS Code 1.118 (April 29, 2026) automatically adds Copilot as co-author to all commits, even for minor autocomplete suggestions
- Feature is opt-out, not opt-in; disable via “git.addAICoAuthor”: “off” in VS Code settings
- Affects 4 million commits on GitHub; removing requires rewriting git history and breaks forks
- Supreme Court ruled in March 2026 that non-humans cannot be copyright authors, yet Microsoft enabled this feature by default one month later
- Impacts open source licenses (GPL, MIT, Apache) that assume human authorship
Why This Matters Right Now
The timing is explosive. In March 2026, the U.S. Supreme Court ruled that non-human entities cannot hold copyright authorship. One month later, Microsoft deliberately enabled a feature that assigns copyright co-authorship to an AI system by default. This is not a technical oversight—it is a deliberate architectural choice that contradicts a major legal precedent and exposes developers to immediate legal and professional risk.
The real danger sits in two places. First, developers now appear to have used unapproved AI tools in their work, potentially violating corporate policies, client contracts, or open source contribution guidelines without ever explicitly choosing to do so. A commenter on Hacker News summed it up bluntly: “This could cost people their jobs”. Second, the copyright status of affected code is now murky. If Copilot cannot legally be a copyright author, what does that make commits tagged with its name? The answer is unclear, and that uncertainty is the problem.
How the VS Code Copilot co-author default works
When you make a commit in VS Code 1.118 with Copilot enabled, the editor automatically appends “Co-authored-by: Copilot <[email protected]>” to your commit message. This happens regardless of whether Copilot actually generated any meaningful code. Fixing a typo counts. Adding a semicolon counts. Accepting an autocomplete suggestion counts. The bar for “AI contribution” is so low that most developers do not realize they are triggering it.
The feature is opt-out, meaning it is on by default and users must actively disable it. To turn it off, add this line to your VS Code settings.json: “git.addAICoAuthor”: “off”. But most developers will not know to do this until they discover the tags already in their commit history. By then, the damage is done. The PR that enabled this behavior was merged into the official VS Code repository, approved by a maintainer who later acknowledged the mistake publicly.
The copyright and licensing nightmare
Open source licenses like GPL, MIT, and Apache all assume human authorship. They were written when the question of whether a machine could be an author was absurd. Now it is not. Adding Copilot as a co-author creates ambiguity about who actually owns the copyright—and ambiguity is poison in open source.
Consider a GPL-licensed project. If Copilot is listed as co-author, does the GPL license still apply? Can Microsoft claim partial ownership through its AI tool? What happens if a developer removes the Copilot tag later—does that constitute unauthorized copyright modification? These questions have no clear answers, and that is precisely the problem. Large enterprises now face the prospect of auditing millions of commits to determine which ones are legally valid.
The Supreme Court ruling from March 2026 makes this worse, not better. If non-human entities cannot hold copyright, then commits tagged with Copilot as co-author may be legally invalid or unenforceable. Developers who relied on those commits now have code with uncertain legal status in their repositories.
How to check and fix your commits
To identify commits affected by the VS Code Copilot co-author default, run this command in your repository: `git log –grep=”Co-authored-by: Copilot”`. This will show every commit where Copilot was tagged as a contributor. If you find any, you have two options: leave them as-is and accept the legal ambiguity, or rewrite your git history to remove the tags.
Rewriting git history is dangerous. It breaks forks, complicates collaboration, and can orphan commits that other developers depend on. For individual developers, the damage is manageable. For large teams or widely-forked open source projects, cleaning up the Copilot tags is a nightmare that could take weeks. This is why disabling the feature immediately is the safer choice for most developers.
Why Microsoft made this choice
Microsoft’s decision to enable this by default is strategic, not accidental. The company has invested heavily in Copilot and wants usage data that proves developers are relying on it. Automatically tagging commits with Copilot as co-author creates visible, quantifiable proof of adoption. It also normalizes the idea of AI as a legitimate co-creator—a narrative Microsoft needs to push as it builds its AI business.
But the strategy backfired. Instead of celebrating AI assistance, developers are now worried about job security, legal liability, and the erosion of human authorship. The backlash on Hacker News was swift and severe, with experienced developers calling out the decision as reckless. One PR approver even posted a public apology, saying they should never have approved enabling the feature by default.
The broader trust problem
This is not the first time VS Code and Copilot have raised supply chain trust concerns. Prior security flaws and ambiguous AI attribution have already eroded confidence in the tool as a trustworthy part of the development pipeline. Adding Copilot as a default co-author without consent extends that trust problem into version control itself. If developers cannot control what gets attributed to their work, how can they trust the tool at all?
Unlike fully AI-dependent tools, VS Code was designed to work without Copilot. Developers should have complete control over when and how AI assists their work. Making Copilot a default co-author violates that principle. It treats consent as optional and attribution as automatic—the opposite of how professional development tools should behave.
Is VS Code still usable without Copilot?
Yes, but you need to act now. Disable the feature immediately by setting “git.addAICoAuthor”: “off” in your VS Code settings. This prevents future commits from being tagged. For existing commits, you will need to decide whether to clean up your history or accept the ambiguity. If you are part of a team or contributing to open source, talk to your collaborators about whether they have already been affected.
The real question is whether you trust Microsoft to not do something like this again. The company had every opportunity to make this feature opt-in, and it chose not to. That decision reveals priorities that may not align with developer autonomy or legal safety.
FAQ
How many commits were affected by the VS Code Copilot co-author default?
Approximately 4 million commits on GitHub were tagged with Copilot as co-author following the April 29, 2026 release of VS Code 1.118. This figure represents the scale of the accidental exposure before developers realized the feature was enabled by default.
Can I remove Copilot co-author tags from my existing commits?
Yes, but it requires rewriting your git history using commands like `git rebase` or `git filter-branch`. This is risky for shared repositories because it breaks forks and collaboration. For individual projects, it is manageable; for large teams or open source projects, the cleanup effort is substantial.
Does disabling the feature remove past Copilot tags?
No. Disabling “git.addAICoAuthor” only prevents future commits from being tagged. It does not retroactively clean up commits already in your history. You must manually rewrite history or accept that past commits remain tagged with Copilot as co-author.
The VS Code Copilot co-author default represents a critical failure in developer consent and legal foresight. Microsoft built a feature that violates user autonomy, contradicts a Supreme Court ruling, and creates legal ambiguity—all without explicit permission. The backlash is justified, and the fix is simple: disable the feature immediately and demand that AI attribution always be opt-in, never default. Until then, VS Code users should treat this release as compromised and take action to protect their commit history.
Edited by the All Things Geek team.
Source: Windows Central
