Safeguarding VS Code against prompt injections

Copilot Chat for VS Code has security vulnerabilities exploitable through prompt injections, potentially leaking GitHub tokens, accessing sensitive files, or executing unauthorized code. Researchers found flaws including improper URL parsing and auto-saving file edits that could modify system settings. Microsoft implemented fixes like requiring URL confirmation, restricting file edits, and introducing tool permissions. Users should use Workspace Trust and consider sandboxing for added protection.