Visual Studio Code

VS Code shipped a Copilot update with browser-agent tools for web app validation, plus a preview Agents window for parallel workflows, BYOK model discovery, and cost visibility. Version 1.128 also adds grouped and workspace-less chats in the Agents window.

Anthropic introduced an MCP extension that lets admins authorize connectors through their identity provider instead of repeated per-user OAuth flows. VS Code added support the same day, which matters because teams can keep connector policy and audit controls in existing enterprise identity systems while reducing setup friction.

Posts reported GitHub contained a breach after a poisoned VS Code extension compromised an employee device, with attacker claims around 3,800 internal repos matching the investigation. Related SHai-Hulud payload reports are pushing teams to audit `pull_request_target`, extension trust, and secret rotation.

VS Code briefly enabled AI co-author tagging by default in its Git extension, then a maintainer said the default will revert to off in 1.119. If you rely on clean commit output, check your Git settings before upgrading.

GitHub expanded semantic indexing beyond GitHub and Azure DevOps remotes, so Copilot can search across more workspace types and repositories inside @code. That improves agent context retrieval in local workflows, while the same release also adds chat-history recall and prompt-eval tooling.