Two CVEs hit GitHub Copilot and Visual Studio Code

Two vulnerabilities affecting GitHub Copilot and Visual Studio Code were published in the US National Vulnerability Database on 8 September 2026. Both are credited to Microsoft products and both allow an unauthorised attacker to disclose information over a network, according to the NVD entries.

The first, tracked as CVE-2026-81380, is described as "improper neutralization of special elements used in a command", the formal name for command injection. In plain terms, that is a flaw where text supplied to a program is passed on to a command interpreter without being properly escaped, so part of the text can be treated as an instruction rather than as data. The NVD entry says the issue in GitHub Copilot and Visual Studio Code "allows an unauthorized attacker to disclose information over a network".

The second, CVE-2026-81381, is categorised as "insufficiently protected credentials" — a flaw where secrets such as tokens or passwords are stored or handled in a way that makes them readable by someone who should not see them. The NVD entry uses the same impact wording: an unauthorised attacker can disclose information over a network.

Both NVD records point to Microsoft's Security Response Center update guide as the sole reference for further detail. The published NVD entries do not include a severity score, an affected version range, or a description of how the flaws could be triggered in practice. They also do not say whether either issue has been exploited.

The pairing matters for anyone running AI coding agents. Copilot operates inside Visual Studio Code, reads files in a developer's workspace, and can be wired up to run commands and call external services. A command injection weakness in that setting is the kind of defect that turns untrusted text — for example, content pulled in from a repository, a dependency or a web page — into something closer to an instruction. A credential exposure weakness in the same toolchain concerns the secrets that a developer environment typically holds, such as access tokens for source control and cloud services. Both NVD entries describe the outcome only as information disclosure, and neither goes further than that.

For defenders, the practical response to entries of this shape is unglamorous. Both Copilot and Visual Studio Code are updated frequently through their own channels, so applying the current release is the primary control. Teams that have granted a coding agent broad shell access, or that keep long-lived credentials in developer environments, have more to lose from either class of flaw than teams that have narrowed those permissions. Rotating tokens that may have been reachable from a developer workstation is a standard step after a credential-handling fix, although the NVD records do not recommend any specific action.

The Agentic Times has not independently verified the technical details of either issue. Neither NVD entry names a researcher or reporting party, and neither states when the flaws were introduced or first reported to Microsoft. Both were published on the same date and within seconds of each other in the database, which is consistent with a single coordinated batch of Microsoft advisories rather than two separate disclosures. Readers who need version-specific guidance will find it only in Microsoft's own update guide, which the NVD cites as the reference for both records.