LLM News Today — 2026-05-03

Microsoft quietly inserted a Co-Authored-by: GitHub Copilot line into Git commits made inside VS Code — even on machines where every AI feature had been explicitly disabled. Developers noticed the injected attribution on May 3, 2026, touching off a debate that goes well beyond a UI annoyance: in open-source projects, authorship metadata isn't cosmetic. It can carry license implications, break contributor agreements, and introduce ambiguity about intellectual-property ownership that some corporate legal teams are not equipped to resolve quickly.

Background You Need

GitHub Copilot launched in 2021 as an opt-in AI pair programmer. Over the following years, Microsoft deepened its integration into VS Code to the point where Copilot suggestions, chat, and commit-message generation share the same settings surface. Users who wanted to work without AI assistance learned to navigate a growing web of toggles — disabling inline completions, turning off chat, opting out of telemetry. The reasonable assumption was that "off" meant off.

Git commits sit at the center of open-source collaboration. Every line of the commit history is a legal artifact: it identifies who wrote what, under what circumstances, and by implication what license governs that contribution. Projects governed by strong copyleft licenses like the GPL, or by corporate contributor license agreements, depend on clean attribution. If a tool silently claims partial authorship on behalf of an AI system, the downstream consequences range from repository policy violations to outright license invalidation in the most aggressive interpretations.

Microsoft is not the first company to face questions about where AI attribution begins and ends. The broader industry has been wrestling with whether AI-assisted code is copyrightable, who owns it, and whether disclosure obligations exist. The VS Code incident lands in that already-fraught context and gives it a concrete, reproducible form: a string in a commit message that developers did not put there and, in many reported cases, had no idea was being added.

What's New

The Co-Authored-by: GitHub Copilot attribution appears in the Git trailer section of commits — the structured block below the commit message body where tools like git interpret-trailers place co-author credits. The presence of the tag in that position is not subtle; any git log --format=full run will surface it. What is subtle is the trigger condition: the injection reportedly occurred even when GitHub Copilot was disabled in VS Code settings, suggesting the behavior is tied to a background service or extension component that continues running independently of the user-facing toggle.

The practical audit path for affected developers is a git log --grep="Co-Authored-by: GitHub Copilot" run across any repository where VS Code was the commit interface. For projects hosted on GitHub, the co-author tag also renders visibly in the web UI, meaning the attribution is publicly indexed and potentially cached by mirrors and archival services. Removing it requires a history rewrite — the kind of operation that is disruptive in shared repositories and impossible in published releases.

Microsoft has not, as of this writing, issued a formal statement explaining the intended scope of the feature or whether the behavior in the disabled-Copilot case is a bug or a design decision. That silence is doing a lot of work right now. Our read is that the most likely explanation is an extension component that was updated to inject attribution by default, decoupled from the on/off state of the user-visible Copilot toggle — a configuration gap rather than a deliberate policy. But "likely" is not the same as confirmed, and the absence of an explanation leaves repository maintainers without the information they need to make remediation decisions.

Open-source project maintainers in particular are now in a difficult position. Accepting a pull request that contains silent AI attribution may violate their project's contribution policy. Rejecting such PRs puts the burden on contributors who may not even know their commits were tagged. Some projects have already begun adding CI checks that fail on the presence of unexpected trailer strings — a workaround that treats a tooling problem as a policy problem.

The Pushback

The counter-argument from Microsoft's perspective, if it ever arrives, will probably be that Co-Authored-by trailers are a widely used convention and that Copilot's involvement in code generation — even at the suggestion level — justifies disclosure. There is a reasonable version of that argument. Transparency about AI involvement in code is something the industry broadly needs more of, not less. The problem is that "transparency" imposed without consent, or triggered by a tool the user believed they had turned off, is not transparency — it's unilateral attribution.

Some developers are skeptical that this represents a meaningful legal risk, arguing that courts have not recognized AI systems as legal authors and that a trailer string claiming Copilot co-authorship carries no enforceable weight. That may be true in most jurisdictions today. But legal clarity on AI-generated code is still actively being established, and building commit histories that contain contested attribution now creates work to undo later, at exactly the moment when AI-IP law becomes settled enough to matter. The developers treating this as a minor inconvenience and the ones treating it as a compliance emergency are both responding rationally to the same uncertainty — they're just assigning different probabilities to the risk.

Separately, May 3 brought other significant signals worth tracking. Xiaomi's MiMo-V2.5-Pro matched Claude Opus 4.6 on coding benchmarks while consuming 40 to 60 percent fewer tokens — a cost-efficiency gap that, if it holds at scale, has real procurement implications for teams running high-volume coding workloads. MIT published a mechanistic paper arguing that superposition — the way neural networks encode multiple features in overlapping directions — explains why scaling reliably improves model performance, offering the first principled account of a phenomenon practitioners have observed for years without being able to explain. And a new ethics benchmark covering 100 real-world moral scenarios found that frontier models diverge sharply in their responses, a finding with direct relevance for anyone deploying AI in moderation, hiring, or healthcare contexts where consistency matters as much as accuracy.

The VS Code attribution issue is the most immediately actionable of the day's stories, but it sits in a broader pattern: AI tooling is moving faster than the disclosure and consent norms that should govern it, and developers are increasingly finding out after the fact.

Source