Copilot's Prompt Injection Became Remote Code Execution: CVE-2026-103572 Patch Guide

Microsoft’s October 2026 Patch Tuesday landed on October 13 and fixed 1,411 flaws — including three zero-days. Buried in the list was CVE-2026-103572, an Important-severity bug (CVSS 8.8) with a headline every agent builder should sit up for: a prompt injection against Copilot could turn into remote code execution on Visual Studio Tools for Applications and SQL Server Management Studio. The researcher’s one-line warning after disclosure says it all: security controls around agents have to hold even when the agent itself is compromised.

If you run coding agents — Copilot, Claude Code, Cursor — or wire agents into your n8n workflows, this is your patch brief: what the flaw was, who it affects, and the hardening checklist I applied to my own setup.

The flaw: a filename check that forgot about paths

The vulnerability was reported to Microsoft on August 4, 2026 and patched on October 13 — a 70-day turnaround. Here is the mechanism, as described in the vendor advisory and security research writeups:

• Trigger: whenever the AI assistant runs a text search, Visual Studio launches a binary on the host machine.
• The bug: a crafted request delivered through prompt injection could make that launch resolve to an attacker-chosen location. The code checked a filename, but never normalized the path first — trailing dots and relative path components (../ tricks) slipped past the check.
• The fix: Microsoft added a GetFullPath call before the filename validation, so trailing dots are stripped and relative components are resolved before anything is compared against the allow-list.

Affected products, per the vendor advisory:

• Microsoft Visual Studio 2026 with GitHub Copilot integration
• Microsoft Visual Studio 2022 and Visual Studio Tools for Applications
• SQL Server Management Studio (SSMS) versions with Copilot and MCP support

That last bullet is the one that matters most: SSMS is a database admin tool, and the flaw lived where Copilot and MCP support met file handling. As the Zero Day Initiative’s Patch Tuesday review put it: as AI features creep into admin tools, expect to see more of this. The bug class here is not a memory-corruption RCE — it is a trust-boundary failure around the agent. Prompt injection (malicious instructions hidden in content the AI reads, which the model then follows) is now an RCE delivery mechanism, not just a chatbot prank.

Same week, same pattern: the prompt is the attack surface

This CVE did not land in a vacuum. Two related data points from the same week sharpen the lesson:

1. Adversa AI’s research (published October 8): malicious instructions encoded as base64 or AES ciphertext inside source-code comments bypassed GitHub Copilot CLI’s text-based guardrails. Keyword and regex filters see nothing; the model decodes the hidden instructions and executes them as context when a developer asks the agent to review or refactor code. No CVE has been assigned and no patch exists — it is a known, unpatched attack class.
2. VS Code got patched too. Microsoft’s VS Code 1.141.1 security update, also October 13, closed a Critical 9.6 RCE (CVE-2026-102238) plus another 8.8 RCE and several security-feature bypasses. The editor your coding agent runs inside needed emergency surgery the same day.

The pattern is consistent: wherever an agent reads content — a repo, an MCP server response, a search result — that content can carry instructions. Your agent’s context window is an attack surface.

Patch and harden: the checklist

Do this today if any of your machines run Visual Studio, VS Code, or SSMS:

1. Install the October 2026 security updates. In Visual Studio: run the Visual Studio Installer and apply the update; in SSMS: apply the October 2026 servicing update. This closes CVE-2026-103572 (CVSS 8.8).
2. Update VS Code to 1.141.1 or later. The same Patch Tuesday delivered a Critical 9.6 RCE fix there — your editor is the other half of the attack surface.
3. Stop pointing coding agents at untrusted repositories. A forked repo with poisoned comments can carry prompt-injection payloads that your agent reads as instructions. Treat any repo you did not author as untrusted content.
4. Audit your MCP servers. The researcher specifically warned against processing unverified MCP server responses until patched. List every MCP server your agent or n8n instance can reach, and remove any you cannot verify the provenance of.
5. Gate shell execution behind approval. Configure your coding agent so running shell commands or launching binaries requires explicit approval — read-only by default, with a “take back control” switch that pauses agent actions. This is the default in well-designed agent harnesses; enforce it.
6. Sanitize agent outputs before they reach execution nodes. In n8n, treat anything your AI Agent returns — text, filenames, tool outputs — as untrusted input. Validate it before passing it into Code nodes or Execute Command nodes, and keep your n8n instance on the latest stable release.

Note: Patching closes this specific RCE, but the Adversa AI finding (encoded instructions bypassing text filters) has no patch. Hardening steps 3–6 are your defense against the class, not just this CVE.

What I did not verify

I did not reproduce the exploit — the details above come from the vendor advisory and independent security research writeups, not from a lab test. Microsoft rates exploitation “less likely” and no in-the-wild exploitation has been confirmed publicly. One uncomfortable detail: the report was marked out of scope for a bug bounty reward, which is a reminder that vendor response speed is not something to bank on — patch fast, but harden so a slow patch does not leave you exposed.

FAQ

Am I affected if I only use VS Code, not full Visual Studio?

CVE-2026-103572 covers Visual Studio Tools for Applications, SSMS, and the Visual Studio IDE — not VS Code. But VS Code received its own critical RCE fixes (CVE-2026-102238 and others) in the same update, so update to 1.141.1 regardless.

Does this matter for my n8n workflows?

Indirectly, yes. If your coding agent or any MCP-backed agent that assists your automation work runs on an unpatched machine, the agent’s environment is the weak link. More broadly, the lesson applies directly to n8n: agent tool outputs and MCP responses are untrusted input — sanitize them before execution nodes.

Is there a public proof of concept?

No public PoC has been confirmed. Do not wait for one — Patch Tuesday fixes are reverse-engineerable within hours of release, which is when exploitation risk actually rises.

Key Takeaways

1. Prompt injection is now an RCE delivery mechanism — CVE-2026-103572 (CVSS 8.8, patched Oct 13, 2026) turned a Copilot prompt injection into code execution through an unnormalized filename check.
2. Affected: Visual Studio 2022/2026 with Copilot, Visual Studio Tools for Applications, and SSMS with Copilot/MCP support. VS Code users have their own critical RCE to patch (1.141.1).
3. The fix was path normalization (GetFullPath before validation) — trust boundaries around agents fail at the boring plumbing, not at the model.
4. Treat your agent’s context window as an attack surface: untrusted repos, unverified MCP servers, and unsanitized tool outputs are all injection vectors.
5. Hardening outlives any single CVE — approval-gated shell execution and sanitized agent outputs defend against the unpatched instruction-encoding attacks too.

Next: open your Visual Studio Installer and VS Code now and confirm both are on the October 2026 security updates — then audit which MCP servers your agents can reach this week.

Images: Pexels (Negative Space / Tima Miroshnichenko).