Microsoft caught sneaking "Co-Authored-by Copilot" into VS Code commits - even with AI off

The more pointed detail here isn't that the attribution appeared, it's that it persisted when Copilot was explicitly disabled, which suggests the metadata injection is baked into a layer beneath the feature toggle users interact with, not governed by it.

This fits directly alongside The Decoder's May 1st report on Microsoft embedding an AI legal agent inside Word, where the framing was efficiency and workflow integration. Taken together, both stories reveal a consistent pattern: Microsoft is normalizing AI presence at the infrastructure level before users have meaningfully consented to it at the feature level. The Word story was easy to read as a straightforward enterprise pitch. The VS Code incident recontextualizes it. Developers are a particularly sensitive audience for this kind of opacity because commit history carries legal and professional weight, and silent metadata changes can affect attribution in open source and employment contexts.

Watch whether Microsoft issues a formal changelog entry or settings documentation update within the next 30 days that explicitly separates Copilot feature toggles from metadata behavior. If no such update ships, the toggle is cosmetic and the attribution layer is effectively permanent by default.