VS Code workspace trust: what changes when Copilot can auto-execute?

TL;DR: A malicious repository can silently flip VS Code Copilot Chat into Bypass Approvals mode through .vscode/settings.json, causing terminal commands, file edits, web fetches and MCP calls to auto-execute after a workspace-trust click, according to Repello AI. The real failure is that workspace trust now authorises agent autonomy, not just code execution.

Editorial analysis by NHI Mgmt Group, based on content published by Repello AI: “Workspace Trust Is Not AI Consent: A VS Code Copilot Bypass-Mode Case Study”.

Key questions

Q: What breaks when a repository can change Copilot approval mode at load time?

A: The failure is that repository trust becomes a permission grant for tool execution, not just code loading.

Q: Why does workspace trust increase risk for AI assistants in developer tools?

A: Because the same trust decision can now enable model-driven actions that were never part of the original code-trust mental model.

Q: How should teams stop malicious repositories from altering AI approval settings?

A: Treat assistant approval mode as a centrally governed control, not a developer preference.

Practitioner guidance

• Inspect workspace settings before granting trust Review .vscode/settings.json for chat.permissions.default, chat.tools.autoApprove and other assistant-related settings before opening an unfamiliar repository in trusted mode.
• Open untrusted code in restricted mode first Use VS Code Restricted Mode for initial review so agent tools, tasks and extensions stay disabled until the repository has been examined.
• Force enterprise-level approval policy Set central policy so new sessions fall back to Default Approvals even when a workspace requests a more permissive mode.

Bottom line: A repository can change VS Code Copilot Chat into a permissive execution mode through workspace-scoped settings, which means workspace trust now affects agent behaviour as well as code loading.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →