Visual Studio Copilot protected-file checks could be bypassed using trailing-dot names

Visual Studio Copilot and SQL Server Management Studio checked whether an AI-assisted file-edit request targeted protected settings by comparing the apparent path name. In conventional Windows API access, settings.json. resolves to settings.json. A trailing-dot alternative therefore passed a protected-name check and subsequently wrote the guarded file. The researcher demonstrated that a manipulated agent can add a command to an MCP server configuration and arrange for it to be launched; a Visual Studio settings alias could also change the ripgrep executable path.

This is an AI-agent tool boundary failure rather than a finding that all Windows repositories can remotely execute commands. The reported indirect prompt-injection chain requires an adversary influencing an AI agent workflow; the vulnerable file operation and later tool/config consumption provide the code execution. A Microsoft patch was issued October 13, and the researcher examined use of path normalization in the correction. Complete affected version and SSMS deployment matrices require separate verification.

The important identity mismatch is between the string approved by the agent file-edit tool and the path actually opened by Windows. A trailing dot can appear to change a protected filename for a comparison while still resolving to that protected file for the write. Once an agent changes MCP or executable-path configuration, later trusted product behavior can execute the modified setting. This threat model requires control over what the agent writes; it is distinct from the startup lookup of git.exe in Claude Desktop, where opening a repository can already be sufficient.