It’s the kind of release-note detail that sounds harmless until you realise what it actually does. VS Code 1.118 shipped with a new default: when Copilot makes changes to your files through chat or agent workflows, the editor automatically appends Co-authored-by: Copilot <copilot@github.com> to your commit message.
Sounds reasonable, right? AI helped write the code, so it gets credit. Transparency is good.
The problem is that Microsoft turned this on by default — and then the attribution started showing up on commits from developers who’d never touched Copilot at all.
What Actually Happened
The change came via PR #310226, which flipped the git.addAICoAuthor setting from "off" to "chatAndAgent". The PR was merged on April 16th with barely any discussion.
Then people updated to 1.118 and started noticing something weird in their git logs.
Developer @flying-sheep reported that even with "chat.disableAIFeatures": true, Copilot was still inserting co-author trailers. @edenchazard found the signature on commits they’d written entirely by hand. @marxoffice called it “vandalism” — and they could prove it:
“On multiple recent commits I hand-wrote every commit message and never touched Copilot while coding, yet there it is — Co-authored-by: Copilot — injected anyway.”
This wasn’t an edge case. It was a bug that attributed AI authorship to work AI never did.
Why Developers Are Furious
The backlash that hit the PR on May 2nd was extraordinary even by open-source drama standards. Over 40 comments in a single evening, most unprintable. Developers threatened to switch to Zed, Neovim, Emacs, and at least one person suggested using a framework called Doom Emacs as their escape route.
But underneath the rage, there are three genuinely important points:
1. Git history is an operational record, not a product growth surface. Commits are used for code review, release automation, compliance, incident forensics, and ownership tracking. When a tool silently rewrites the record, it’s not a quirky feature — it’s a policy change that nobody consented to.
2. False attribution is worse than no attribution. If Copilot’s name shows up on commits it didn’t contribute to, the entire signal becomes worthless. Teams can’t trust the metadata. Managers can’t use it for anything. And developers who legitimately used AI get lumped in with people who didn’t.
3. “Co-authored-by” has legal weight. The Co-authored-by trailer in Git is based on the DCO (Developer Certificate of Origin) format. It’s a statement of authorship with implications for licensing and intellectual property. Stamping it automatically — especially inaccurately — is not just annoying, it potentially creates legal confusion about who actually wrote the code.
One developer, @Vzor-, put it bluntly: “This borders on fraud. Claiming co-authorship is a legal statement, with legal implications for re-licensing code.”
The Strategic Logic — And Why It’s Concerning
Microsoft isn’t doing this out of naivety. Structured metadata in commit trailers is far more useful than self-reported surveys for measuring AI adoption. Once Co-authored-by: Copilot is in the git log, you can aggregate it by repo, by team, by timeframe, by feature surface.
That’s valuable for enterprise reporting. It’s valuable for Microsoft’s narrative that Copilot is deeply embedded in software delivery. And it’s valuable for investor decks showing AI adoption metrics.
The problem isn’t that Microsoft wants this data. The problem is that the default was set to collect it silently, and the implementation was buggy enough to generate false positives.
As Moony01’s excellent analysis puts it: “A team-level or org-level policy that says ‘we require AI attribution’ is governance. A product default that silently decides the convention for everyone is product steering.”
Microsoft’s Response
To Microsoft’s credit, the response came relatively quickly. VS Code developer DmitrivMS acknowledged the issues:
- It should never have been enabled when
disableAIFeaturesis on.- It should not add attribution to changes that were not done by AI.
- We need to make sure it receives more test coverage before changing the default.
A follow-up PR #313725 was opened to revert the default back to off, and PR #313931 is the fix targeting version 1.119.
The fix is coming. But the incident reveals something important about how Microsoft thinks about developer trust.
The Bigger Pattern
This isn’t an isolated incident. It’s part of a pattern:
- Copilot billing changes — Microsoft shifted GitHub Copilot to token-based billing and pulled Claude Opus from cheap plans, because the compute costs were unsustainable. The $10/month AI coding era is ending.
- Copilot everywhere — Microsoft is embedding Copilot into every surface of the developer experience, from Word to VS Code to Azure. The co-author default is part of that push.
- Silent defaults — Each change ships as a reasonable-sounding default. Token billing makes costs transparent. AI co-authoring makes attribution transparent. But the defaults consistently expand Microsoft’s data collection and lock-in, and the “transparency” only flows one way.
Developers aren’t stupid. They notice when every “helpful default” also happens to benefit the platform that set it.
What You Should Do Right Now
If you’re on VS Code 1.118, check your recent commits for unexpected co-author trailers. Then add this to your settings:
{
"git.addAICoAuthor": "off"
}
If your team wants AI attribution, make that a deliberate policy decision — not something the editor decided for you. And if you’re genuinely interested in tracking AI contributions accurately, wait for Microsoft to ship a version that doesn’t attribute ghost authorship to commits AI never touched.
🔍 The Bottom Line
The co-author feature itself isn’t the problem. AI attribution is a legitimate conversation. But Microsoft shipped it as a silent default with buggy implementation that falsely claimed AI authorship on human-written code. That’s not transparency — that’s metadata vandalism dressed up as a feature.
The fix is coming. The trust damage is already done. And every developer who found “Co-authored-by: Copilot” on a commit they wrote by hand now has a very reasonable question: what else is the editor deciding for me?
