The report
Microsoft addressed a Visual Studio Copilot protected-file weakness disclosed on October 13 in which an attacker-influenced agent could edit sensitive configuration through a trailing-dot filename alias. Under Windows path handling, a request for .mcp.json. can resolve to .mcp.json, while a string comparison against the protected name may consider the two different. The authorization decision and the filesystem operation then refer to the same underlying file under different names.
The researcher described command execution through modified MCP server configuration and an executable path in settings.VisualStudio.json. The agent needed to be induced to perform the edit and the modified configuration needed to be consumed later. This was not simply a user directly choosing to execute an arbitrary program, nor evidence of a confirmed production compromise. The disclosure concerns Visual Studio and related SQL Server Management Studio configurations; exact build-level verification remains important.
A protected file must be identified after normalization
The intended check was 'the agent cannot edit this privileged configuration'. What failed was the mapping between the requested filename and the object the operating system ultimately opened. A file filter should base authorization on a canonical target path and apply the same normalization rules used by the actual write operation. Further tests should include trailing dots and other permitted Windows aliases, rather than only strings that literally match protected filenames.
This contrasts with the Claude Desktop Windows Git search-path issue, where project-controlled content could be launched during application startup without the model first editing a protected configuration. The Visual Studio Case captures the separate prerequisites. The original researcher disclosure could not be retrieved in this run, and a comprehensive comparison across patched Visual Studio and SSMS builds remains an evidence gap; no additional patch-performance assertion is made here.