Starting with VS Code’s April 1.117 update, “Co-authored-by: Copilot” was appearing in commit history without developers putting it there. AI commit authorship had been flipped from opt-in to opt-out: a single pull request changed git.addAICoAuthor from "off" to "all", and every project open in VS Code started receiving the Copilot attribution trailer on every commit. According to Thomas Claburn’s report in The Register, it appeared even when Copilot was disabled, even after developers had manually rewritten their commit messages. Microsoft reversed the default after 372 thumbs-down on a public issue and almost no support.
The reversal came fast. The fact that this happened at all is the part worth examining.
How the Default AI Commit Authorship Worked
The technical change was minimal. PR #310226 switched git.addAICoAuthor from "off" to "all" in the VS Code extension configuration. No opt-in dialog. No prominent changelog entry explaining the practical effect. Every project open in VS Code would have Copilot’s name appended to every commit trailer, regardless of whether the AI assistant had been used for anything.
The case that drew the most attention was also the clearest: a developer had reviewed the commit message, rewritten it by hand to replace Copilot’s generated version, then committed. The attribution line appeared in the final log anyway. In their words: “This means the message I reviewed before committing was not the final content that ended up in Git history.”
This is not a cosmetic problem. The commit the developer approved and the commit that reached the repository were different objects. For that commit, the entire review chain was broken. GitHub issue #314311, opened to track the situation, collected hundreds of reports before Microsoft reverted the setting.
Git Log Is Not a Credits Section
git blame and git log are not for tracking moral credit. They answer operational questions: who introduced this logic, when, in what context, and as part of which decision. In teams with structured code review, they are part of the daily internal audit trail, not a footnote.
In regulated environments, the stakes are higher. For teams building financial systems or healthcare software, commit history can carry legal weight during external audits or post-incident reviews. Adding a non-person entity to that record, one that cannot sign contracts, cannot be sued, and bears no accountability for anything it “co-authored”, is not a neutral act. It changes what the record means.
The question of copyright over AI-generated code is already unsettled. Anyone who has looked at the legal problems around AI-assisted code and GPL licenses knows there are no clean answers. Automatic attribution of Copilot in git history does not clarify anything. It adds another actor to an already ambiguous picture, one with zero legal standing for what it supposedly contributed.
Defaults Are Not Neutral
Microsoft framed this as “AI provenance”: transparency about where AI contributed to the development process. That framing has logic to it. The implementation does not.
Opt-out means that whoever updates VS Code without reading the release notes, which is most people during an automatic update, participates in the mechanism without choosing it. This is how normalization works at scale: behavior gets shipped first, resistance has to be active and informed. Microsoft builds software products for hundreds of millions of users. The company knows precisely what opt-out means for adoption curves.
Microsoft makes both the IDE and Copilot. Automatic attribution on every commit positions Copilot as a standard collaborator in the development workflow. Every project with that line in its history is, implicitly, a product demonstration. No malicious intent is required to recognize that the mechanism serves a specific commercial interest, and that commercial interest belongs to the company choosing the default.
The rollback came within a few days. That is not evidence that the system works. It is evidence that the reaction was loud enough to make the political cost exceed the benefit. The logic that produced the original default is unchanged.
What This Actually Means
An IDE is a tool that executes developer intent. It should never add its own declarations to the output of that work. A commit is a statement: “this is what I reviewed, modified, and approved.” Altering that statement without explicit consent crosses a line that would be unacceptable in any other professional tool, from a text editor to a build system.
In any team that uses git log to reconstruct decisions made about code, a commit whose content depends on an editor configuration parameter that can change silently between versions is not a reliable document anymore. Not because of a code bug: because of a deliberate tool behavior. The developer never controlled that setting.
The most revealing part of this story is not the commit authorship. It is that this change was caught because it was visible: an extra line in every commit message shows up immediately the next time someone runs git log. Less visible default changes, covering telemetry, network behavior, or integration with external services, create the same structural problem with far less chance of triggering hundreds of negative reactions within twenty-four hours.
The IDE-as-platform model pushes in this direction. As more capabilities integrate into the editor, the editor’s defaults become decisions that matter for your workflow, your compliance posture, and your traceability. Every feature shipped as opt-out is another area where you are, knowingly or not, delegating a choice to the vendor. The feature itself may be fine. The delegation is the problem.
Microsoft fixed the commit attribution. The structure that made it possible, where a single PR can silently change what ends up in your git history, is still there. It applies to any default that comes next.
Conclusion
Public pressure wins change timing, not intent. The next problematic default will arrive with better framing, lower visibility, in an area where the consequences are less immediate than an extra line in a commit message. Picking tools with the knowledge that their defaults belong to someone else is the starting point for using them with any real degree of control.