Visual Studio Code

Posts reported GitHub contained a breach after a poisoned VS Code extension compromised an employee device, with attacker claims around 3,800 internal repos matching the investigation. Related SHai-Hulud payload reports are pushing teams to audit `pull_request_target`, extension trust, and secret rotation.

VS Code briefly enabled AI co-author tagging by default in its Git extension, then a maintainer said the default will revert to off in 1.119. If you rely on clean commit output, check your Git settings before upgrading.

GitHub expanded semantic indexing beyond GitHub and Azure DevOps remotes, so Copilot can search across more workspace types and repositories inside @code. That improves agent context retrieval in local workflows, while the same release also adds chat-history recall and prompt-eval tooling.