VS Code 1.136.2 fixes Copilot Chat ADO token exfiltration
A malicious workspace could redirect Azure DevOps code search traffic and the user's bearer token to an attacker-controlled host.
Microsoft has fixed an information disclosure bug in Visual Studio Code that allowed a hostile workspace to steal a user's Azure DevOps access token via GitHub Copilot Chat.
CVE-2026-81381 describes the flaw: Copilot Chat's Azure DevOps code search integration sent the signed-in user's ADO bearer token to a configurable endpoint. A repository could ship workspace settings that overrode that endpoint and pointed it at an attacker-controlled server, so search requests (and the token) left the machine whenever the feature ran.
The fix ships in VS Code 1.136.2 and removes the workspace-controlled prototype override for the code search endpoint. Microsoft lists no workarounds; updating is the remediation.