GitHub Copilot silently inserts itself as a co-author after I manually replaced the generated commit message

[yangyijie912]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

VS Code

Body

I want to report a serious issue with GitHub Copilot’s commit message generation workflow.

GitHub Copilot inserted the following line into my Git commit message:

Co-authored-by: Copilot copilot@github.com

The most concerning part is that I had already checked the commit message before committing. I deleted Copilot’s generated English commit message and manually wrote my own commit message instead. However, after the commit was created, the final Git history still contained the Copilot co-author line.

This means the message I reviewed before committing was not the final content that ended up in Git history, or Copilot/VS Code added co-author metadata after my manual edit. That is unacceptable in a professional development workflow.

Commit metadata is part of the project’s accountability, review, deployment, and audit trail. Copilot only generated a commit message suggestion; it did not author the code. It should never silently add itself as a co-author, especially after the user manually replaces the generated message.

This behavior is also inconsistent. It does not happen on every commit, which makes it behave like a random hidden trap. I only discovered it when checking recent Git commit history before deploying to a test environment.

Please treat this as a product safety and trust issue, not a cosmetic issue.

Requested changes:

Make AI co-author attribution strictly opt-in.

Never add Co-authored-by metadata unless the user explicitly confirms it.

Provide a setting to permanently disable Copilot co-author attribution in commit messages.

Ensure the commit message shown to the user before committing exactly matches the final message written to Git history.

Clearly document when and why Copilot may add commit trailers or metadata.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[mene6]

Remove, no one asked for this bug

[aeltorio]

@yangyijie912 patch the SDK (here is my patch (with perl) for 0.45.1)

#!/bin/bash
set -eu

if [ $# -ne 1 ]; then
  echo "Usage: $0 path/to/@github/copilot/sdk/index.js"
  exit 1
fi

file="$1"

perl -pi -e '
  s/if\(!vr\(e,lXe\)\{/if(!vr(e,lXe) && e.includeCoAuthoredBy!==false){/;
  s/if\(!n&&r.cwd&&vr\(e,lXe\)\)\{/if(!n&&r.cwd&&vr(e,lXe) && e.includeCoAuthoredBy!==false){/;
' "$file"

echo "Patched $file"

patch-copilot-sdk.sh

[dere36100]

@aeltorio how can I patch it with Macos ?

[aeltorio]

just paste in a terminal:

curl -fsSL https://github.com/user-attachments/files/27124688/patch-copilot-sdk.sh -o /tmp/patch-copilot-sdk.sh
bash /tmp/patch-copilot-sdk.sh

[evoactivity]

I've also been seeing this, it's rather annoying.

[weblate-highcanfly]

@aeltorio You're a genius 👍 🥇

[muhammad4dev]

Go to settings and turn off the "Git: Add AI Co Author" setting.

Or add this to your settings.json file:

"git.addAICoAuthor": "off"

[NovemLinguae]

Go to settings and turn off the "Git: Add AI Co Author" setting.

This worked. Thanks. P.S. This setting is in VS Code, not github.com.

[ncauwet-highland]

I'm glad there's a setting to disable it, but there should be a git-wide setting for it not just in VSCode. I disabled it on my work computer and forgot to disable it at home and ended up pushing an official commit with the setting enabled.
Regardless of whether a user wants to use this setting or not, the message should be included in the human-readable git commit message before the commit is made. It was silently added to a long commit message that I thoroughly reviewed multiple times.

[psimsa]

Why the heck would anyone who's still not fully done fighting past reputation crisis add this as a default setting, even for inline completions?

[lethargosapatheia]

The actual question is: why are you using copilot (and github) in the first place? All the past Microsoft-related catastrophes just haven't been enough, I guess.

[christophe-g]

That is beyond what I can grasp. https://news.ycombinator.com/item?id=47966278

[pWoLiAn]

The actual question is: why are you using copilot (and github) in the first place? All the past Microsoft-related catastrophes just haven't been enough, I guess.

tell that to my employer bucko

[jammsen]

The actual question is: why are you using copilot (and github) in the first place? All the past Microsoft-related catastrophes just haven't been enough, I guess.

tell that to my employer bucko

Same here, Ignore troll-posters 😎

But imagine you writing code, hundreds of lines, files over files, AI did nothing but confuse you with "auto-complete for wrong indention" while you try to indent 1 yml file and CoPilot says, well i worked on this too! Mine! 🤷 Such a weird thing to implement ... not even based on facts. I can write 500 lines of code and ask the ai for the weather and CoPilot says its his code? 🤣

[up201306506]

I had it generate a commit message, immediately deleted it and wrote my own, and it still had the message there. Great. AI doing highschool group assignment grade coasting was not on my bingo list of jobs they'll poach.

[AAltemus]

This 100% needs to be opt-in. Especially if you're going to replace intellisense and consider that a co-author.

[dmitrivMS]

Switched back to opt-in in 1.119.

[dmitrivMS]

FYI - more updates in microsoft/vscode#314311

[ndamulelonemakh]

Apart from marketing GitHub Copilot, what is the upside of this, for the developer that is?

[dmitrivMS]

This is not for marketing, but for teams who want to see AI attribution in commits.

[Querela]

Shame the developer? 😔

According to the OP:

Commit metadata is part of the project’s accountability, review, deployment, and audit trail.

Adding the note that you used AI in your workflow is a positive aspect. If you use a model with dubious source material that might violate copyright, it is okay to add this notice at the end of the commit message. It protects you from future lawsuits as you "admit", you might have used code generated by AI (it even helpfully add the model name). They could have communicated that change a bit better, maybe highlighted the positive aspects ... but Microsoft.

But doesn't Claude Code do the same with the commit message?

[marcoieni]

I found this in the settings:

[hamadhk7]

Yeah this is actually a known behavior in VS Code, and it’s not coming from Git itself but from the Copilot integration.
Git does not add co authors automatically. That line is being injected by VS Code when Copilot is involved in commit message generation.
You can disable it with this setting:
In VS Code settings search for
Git Add AI Co Author
and turn it off
or directly in settings.json:

“git.addAICoAuthor”: false

After disabling that, Copilot should stop adding the co authored by line entirely.
Also what you described about the message changing after review is likely because VS Code modifies the commit message at commit time, not exactly what is shown in the input box. So your concern about trust and audit trail is actually valid.
This should definitely be opt in, not enabled by default.

[dmitrivMS]

Switched back to opt-in in 1.119.

[Querela]

Let's be honest, who would opt-in to something like this (voluntarily) or any other kind of data collection.

I think opt-in is a good default, only opt-out if you want to hide the shameful fact of using AI. Be proud and stand tall.

[AAltemus]

I disagree. You should not be changing our git commit message without specifically asking us to opt-in. There are many reasons for this, some touching legal issues.

[dmitrivMS]

@AAltemus Agreed. Please see details in microsoft/vscode#314311

[gk-volane]

This is not right. Seems like they are operating in bad faith here, this should have been toggled off by default.

[gk-volane]

I also saw from a newsletter that Copilot is doing away with annual subscriptions and customers with existing annual subscriptions will have no new models or features.

[vcprocles]

Or, at least have it on other option, and add coauthor if there are chat or agent edits. Having this added to ALL commits is crazy

…

-------- Original Message --------

On Wednesday, 04/29/26 at 12:30 gk-volane ***@***.***> wrote: This is not right. Seems like they are operating in bad faith here, this should have been toggled off by default. — Reply to this email directly, [view it on GitHub](#194075 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AUGCDIEBIGK56E5KPEJMVLT4YHDU3AVCNFSM6AAAAACYHMJXNKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNZVGM4DQNA). You are receiving this because you commented.Message ID: ***@***.***>

[jmjoy]

Linus would absolutely tear this 'git.addAICoAuthor' feature a new one.

The Linux community explicitly forbids using 'Co-authored-by' for AI tools or models; they insist on using 'Assisted-by' instead.

[pWoLiAn]

i have seen linux tools do the same thing

[dmitrivMS]

Like this?
https://github.com/torvalds/linux/blob/master/Documentation/process/coding-assistants.rst#attribution

[mene6]

if anything its just a cheap way to insert your name into commit messages, probably idea from microslop

[sanderrr]

I now expect a practical tool for editing the commit text from VS

[realquantumcookie]

It's ridiculous that I only used autocomplete and it automatically inserts itself as a coauthor. Like seriously?

[pWoLiAn]

dont use autocomplete then. easy.

[typed-sigterm]

PR submitted: microsoft/vscode#313725

[dmitrivMS]

Thank you, as I discussed I had to rework this into a new PR, but it is merged.

[Almas-Ali]

Totally annoying.
It wants to take credit for every change in the codebase!

[letanloc1998]

Copilot is a co-author, so this code belongs to Copilot.

That means they can use your code and sell it to others.

[gaffarmalik]

It's very ridiculous that this is even enabled by default, especially for users that have signed commits enabled.

[thediveo]

The fun thing is that this trips up COA and similar legal guard rails for commits and committers.

[SoneNiko]

Oh my bad. I missed the part where the blogpost only mentioned a "commitment to WINDOWS quality"

How can a company in their right mind be so aware of the problems in one of their products while being so painfully unaware that an EQUALLY NAMED feature is causing THE SAME problems in another software they maintain.

What happened? Was not everybody on board with the quality part?

How about you apply this to all other products as well. Assuming it was ever more than a bunch of fake promises to begin with that is

[dmitrivMS]

What do people think about Assisted-By trailer instead as suggested here:
microsoft/vscode#313962

[kfern]

It's a tool like others. I don't understand why do you try to have credits

[WolfspiritM]

Does that mean our commits will look like this in the future?

"Fixed a typo

Edited-By: VSCode
Assisted-By: GitHub Copilot
Co-Assisted-By: Claude Code
Spell-Checked-By: Grammarly
Linted-By: ESLint
Formatted-By: Prettier
Debugged-By: Chrome DevTools
Copied-From: StackOverflow (answered 2014)
Transferred-By: Cisco Router
Transmitted-By: Cloudflare CDN
Powered-By: Intel Core i9
Typed-With: Razer BlackWidow Keyboard
Clicked-With: Logitech MX Master 3
Illuminated-By: LG 4K Monitor
Caffeinated-By: Nespresso Vertuo
Motivated-By: Pending Jira Ticket
Reviewed-By: Nobody (merged anyway)
Approved-By: CI/CD Pipeline (barely)
Deployed-By: Jenkins (third attempt)
Rolled-Back-By: Jenkins (fourth attempt)
..."

[jammsen]

@WolfspiritM thats awesome! Thanks for that, made my evening! 😎

[jehillert-ziosk]

I would prefer this "feature" be removed.

[dmitrivMS]

Please see details in microsoft/vscode#314311

[VegaDiscoveries]

Why Is No One Pointing This Out?

GitHub Copilot and AI Authorship: A Misattribution Problem

GitHub Copilot generates no AI content — the underlying models do the work.
For GitHub to claim co-authorship is to appropriate credit that belongs to
whichever model was actually in use.

This is a broader misattribution, and a false claim on its face.

[jammsen]

True, but it says Co-Author, not Co-Ownership.
But i agree, if Copilot is a wrapper around Claude, the Co-Author isnt Copilot its Claude.

[dmitrivMS]

FYI - we have posted more details on what happened and some analysis here:
microsoft/vscode#314311

[thediveo]

For you information, here is also another independent view of the situation, by David Gerard: https://m.youtube.com/watch?v=Ai5vZmRThFk. He points out that a manager with a public contribution history of what he describes as vibe coding is (still) allowed to get his changes put to the world due to automatic AI greenlighting. Which safeguards are you concretly putting in place against your own managers introducing this kind of unfeatures?

[VegaDiscoveries]

Does your code/process make any determination on whether an AI was used to create or modify documents vs simply used to streamline the commit and push to github?

[Anthonysmith56]

That's good

[VegaDiscoveries]

How much Attribution should be given to AI

Not every contributor to a project ALWAYS gets attribution.

Does Everyone get Attribution

In my office we are viewing AI in some ways as we would view another co-worker. We must train the co-worker, and for AI we must ensure re-training occurs for every session. We must oversee the co-workers work, and AI work must be reviewed and validated. We compensate the coworker based on mutually agreed terms, and there is money paid to utilize most AI models, or there is no payment required - which is a valid contract.
Just because a co-worker was invloved in a project, has no bearing on whether or not that coworker receives any attribution in a project authorship page. The same should be true of AI.

Does a Contractor get Attribution

Another parallel, perhaps even more appropriate, is a scenario where a contractor is hired to assist for a specified purpose. The contractor, having no long-term affiliation with the company, has zero expectation for attribution or ownership of intellectual property.

Ownership Claims

Most important, just because a co-worker, or a contractor, worked on a project does not offer the person any claim of ownership for the work that is actually owned by the company. If I have a subscription from Github, Anthropic or anyone else, to use their tools, then there is a contract in place that governs the use of those tools. The vendors have pre-approved the tool use for specified renumeration. Are we signing away a portion of our intellectual property rights to works just because of the tool used to complete the works? I would hope not.

AI is a Tool

Notepad is a tool. VS Code is a tool. Other IDE's are tools.
Current AI is a tool being used to assist in work. AI cannot perform work it is not tasked to perform.
If I create a skill for AI to run - that can be compared to building a macro that gets launched based on certian business cycle events or application life cycle events. Does this mean macros and other code snippets get attribution? Just because their scope of knowledge is smaller - does that make them less warranting of attribution.

----

I have been involved in software development for over 40 years. I have seen the evolution of tools to aid in the creation of work products. This has not been limited to software development.
Current AI is not able to come up with new ideas, it only pulls from information it already knows about or already exists.

I suggest we all take deep breathe.... This post is attributed to Richard Hancock - thats all!