Copilot in VS Code commits even with AI disabled

What happened: Copilot's silent co-authorship

In the early days of May 2026, several developers reported anomalous behavior in Visual Studio Code. Microsoft had introduced an automatic line in Git commits: “Co-Authored-by: GitHub Copilot” . The main problem was not the line itself. It was the fact that it appeared even when the user had explicitly disabled all AI features of the editor.

The news was documented in detail by The Decoder , which reconstructed how the change had been introduced without official communication. Therefore, many teams found themselves with unexpected metadata in their repositories, without having authorized them.

Furthermore, the change concerned a particularly sensitive area: versioning logs are technical documents with legal and contractual value in many business contexts. Therefore, even a seemingly innocuous line can have non-trivial consequences.

Immediate impact on development workflows

For SME development teams, this episode has a direct impact on at least three operational levels.

The first concerns the code traceability . Commit messages are the historical memory of a software project. Automatically inserting an external co-author alters that memory. Consequently, during audits or code reviews, references emerge to a tool that may not have contributed in any way to the actual writing.

The second level concerns the intellectual property . In some software development contracts, code authorship is an explicit element. However, with automatic co-authorship, it becomes more complex to prove that the code was produced entirely by internal human resources. This aspect is already at the center of an international legal debate, as also reported by Harvard Business Review regarding AI and professional creativity.

The third level is that of corporate compliance . Many organizations have internal policies on the use of AI tools, often linked to certification requirements or contracts with enterprise clients. Therefore, automatically inserted metadata could conflict with these policies, even if the AI was not actually used.

Community reaction and Microsoft's response

The developer community reacted quickly. On GitHub and in specialized technical forums, numerous threads have documented the behavior and requested clarifications. Some users have defined the change as an example of dark pattern applied to development tools.

Microsoft, following the reports, acknowledged the issue and announced fixes. However, the initial communication management was considered insufficient by many observers. In particular, the absence of a transparent changelog fueled the perception of a change deliberately introduced in a low-visibility manner.

This episode isn't an isolated incident. In fact, in recent years, several development tool vendors have progressively expanded AI functionalities in their products, often changing default behaviors without explicit user consent. As reported by Wired, the tension between automation and user control is one of the central themes in the evolution of modern IDEs.

What nobody says: the problem is in the defaults, not in the AI

It is important to separate two distinct issues. The first: the use of Copilot as a development tool. The second: the management of metadata generated automatically by the tools.

Copilot can be a useful tool for accelerating code production. However, this doesn't mean that every interaction with the editor should leave traces in the repositories. On the contrary, the choice of whether or not to document the contribution of an AI tool should rest with the development team, not the vendor.

Also, the VS Code situation highlights a structural issue: most devs don't read release notes as carefully as they read code. As a result, changes to default behaviors go unnoticed until someone stumbles upon them by accident. This is especially true for small businesses, which often lack a dedicated team to manage development tools.

We at SHM Studio we observe it regularly in projects of AI consulting with our clients: tool governance is often the most overlooked point of technological adoption.

What to do now: three operational checks for SME teams

For SME development teams using VS Code, it is advisable to proceed with some immediate checks.

• Check recent commits. Searching the Git log with the filter on the text “Co-Authored-by Copilot” allows you to quickly identify which commits were affected by the automatic modification.
• Review VS Code settings. In particular, check the active extensions and configurations related to GitHub Copilot, even if the extension is disabled. Some behaviors may persist at the global editor configuration level.
• Update internal policies. If the company has contracts that specify code ownership, it is advisable to add an explicit clause on the management of metadata generated automatically by development tools.

In addition to this, it is advisable to activate a process of periodic review of the release notes of the main tools used by the team. In fact, this type of change is not the only one that can go unnoticed in an automatic update.

To deepen the implications of AI in business processes, our AI services and the resources of SHM Studio blog offer updated analyses. For those managing complex digital projects, the services of also web development and Digital marketing integrate an assessment of the adopted technological tools.

Perspectives: towards governance of AI tools

This episode is likely a preview of dynamics that will become more frequent in the coming years. As vendors integrate AI more deeply into their tools, the distinction between active functionality and passive behavior will tend to blur.

Therefore, SMEs that want to maintain control over their development processes will need to adopt a more structured approach to tool governance. This includes not only choosing tools but also defining clear policies on what they can do autonomously and what requires explicit consent.

According to the analyses of Gartner , by 2027-2028, most development tools will include AI features enabled by default. As a result, consent and transparency management will become a central theme not only for large enterprise teams but also for smaller businesses.

In summary, the Copilot-VS Code case isn't just a technical issue. It's a signal that AI governance in daily workflows requires increasing attention. For Italian SMEs, starting to structure this governance today means avoiding more complex problems tomorrow. Those who want support in this direction can explore our services or contact us directly. Likewise, for those who want to deepen the overall digital strategy, the services of SEO , Copywriting , Google Ads and LinkedIn Ads complete a coherent and controlled digital ecosystem.