What Happened
On May 2, 2026, developer @devnull_ posted on X that their Git commits contained a Co-Authored-by: GitHub Copilot trailer — despite having disabled Copilot entirely in their VS Code settings. The post went viral, accumulating 45,000 likes and 12,000 retweets within 24 hours.
Further investigation revealed the behavior was introduced in VS Code v1.98 (released April 15). The feature adds a Copilot attribution to any commit made while VS Code is open, regardless of whether Copilot was used to generate the code. Microsoft's stated reason: "tracking AI-assisted development patterns."
The problem? There was no opt-in, no notification, and no documentation of this behavior. Developers had to discover it by examining their Git logs.
The Trust Problem
This incident strikes at the heart of a growing tension in AI tooling: who controls the metadata of your work?
For developers, Git commits are a professional record. Having your name associated with AI-generated attribution — especially when you didn't use AI — is not just incorrect, it's potentially damaging. Consider the implications:
- Professional credibility — recruiters and hiring managers scanning GitHub might assume AI-generated code
- IP and licensing — AI attribution could complicate copyright claims on original work
- Audit trails — regulatory compliance in finance and healthcare requires accurate commit metadata
- Open source contributions — maintainers may reject PRs with unwanted AI attribution
Microsoft's Response
Microsoft issued a statement within 48 hours, calling it an "unintended side effect" of their AI telemetry system. They released VS Code v1.98.2 which removes the automatic attribution and adds a visible toggle in settings.
But the damage to trust was already done. The developer community's response was scathing:
- "If they're doing this without telling us, what else are they doing?" — Hacker News top comment
- "This is exactly why I moved to Zed." — Multiple replies on X
- "Trust is earned in drops and lost in buckets." — @techlead_ on LinkedIn
The Bigger Picture: AI Attribution Standards
Beyond the immediate controversy, this incident highlights the need for AI attribution standards in software development. As AI coding tools become ubiquitous, the industry needs clear rules about:
- When and how to attribute AI-generated code
- Who owns the metadata in developer tools
- What opt-in vs opt-out means for telemetry
- How to audit and verify AI usage in codebases
I use AI coding tools daily, and I want attribution when AI actually generates my code. But Microsoft's approach — silent, unavoidable, inaccurate — is the worst possible implementation. It undermines the legitimate case for AI transparency. If you're building AI tools, make attribution opt-in, visible, and accurate. Anything less erodes trust for everyone.