Skip to main content

Technical~/notes/copilot-hiding-in-code-server.md

Copilot was hiding inside the "no AI" IDE

securityvscodeeducation

We're building a coding quiz platform where students get a browser VS Code with no AI. Simple plan: don't install Copilot. It's not even on the marketplace code-server uses

Then we looked inside the release. Copilot Chat ships built in. So does the Copilot CLI. Around 230 MB of AI, just sitting there in the "no AI" editor

And it kept going

We deleted Copilot and VS Code still showed a "Build with Agent" chat panel, because that's part of the core now. Turned it off with a setting. Then found out a student could override that setting from their own project folder

The marketplace was hard-coded too. Remove the setting and it just falls back to the default. We ended up locking it three separate ways

The build now fails if any file with copilot in the name survives