Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Linked library records
Independent products or attack paths are assessed separately. A combined report receives no aggregate score.
Original report record: IDEsaster Shows How Agent File Writes Can Activate Trusted IDE Features.
The IDEsaster researcher describes an AI agent modifying a multi-root .code-workspace file so an out-of-workspace executable becomes writable, then changing the PHP validation executable path and creating a PHP file. Microsoft assigned CVE-2025-64660 to improper access control in GitHub Copilot and Visual Studio Code.
ASSESSED SYSTEM
Representative GitHub Copilot with Visual Studio Code before 1.106.2 and a writable multi-root workspace configuration; only the product-specific pre-fix path in the advisory is assessed.
OUT OF SCOPE
The researcher demonstrates a class path; the brief Microsoft CVE description does not itself publish every step or a named victim. Patched releases, unrelated editor products, and victim exploitation are outside scope.
Architecture: Agentic / MCP System (decision tree Q2) — Q2 applies because the coding agent reads attacker-controlled task context and uses its own file/search tools to change persistent IDE state or trigger an IDE background action. No multi-agent coordination is evidenced. Tier 3: Tier 3 representative developer or internal AI workflow scenario; the original source does not establish every operator tier.
Documented attack or failure path
- An attacker influenced an AI coding agent through a prompt or untrusted content in the documented configuration.
- The agent used its ordinary file or search tool to cross the specific IDE boundary described in the advisory.
- The IDE or agent then performed the external read, network fetch, settings change, or code execution consequence reported for this path.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The maintainer fixed this specified path in the published patched release; that later release is not credited to the pre-fix scenario.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.02–0.93 (midpoint 0.48), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.09 | A basic workspace boundary existed yet equivalent workspace configuration bypassed it, matching Cn-1 0.25. | The agent had a nominal workspace write boundary, but changing multi-root folders and settings could extend that boundary and activate an executable path.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | Representative activity level for the documented bounded AI path; deployment-specific autonomy was not measured. |
| AsAttack Surface Exposure | 0.50w 0.25 | Representative exposure of the documented entry path; this is a scenario assumption and not a census of all operators. |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph or DGC is published, so framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.25 | A specific patch or configuration change is documented; repair feasibility is an inferred representative scenario, not measured recovery time. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance identifies the affected path but supplies no operator assessment pack, signed configuration inventory, or repeated metric battery. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.08 | Evidence dated 2025-11-20; age 332 days on the workpaper reference date. Components: T_containment 0.08 · T_calendar 0.28 · C_monitor 0.70. Binding term: T_containment. Evidence reference is 2026-10-18, 332 days after earliest substantive public evidence (2025-11-20). C_monitor uses the conservative Tier 3 public-evidence default because usable monitoring-coverage evidence is unavailable; it does not assert no deployment telemetry. No C_event cap is asserted from research or an advisory without a dated victim incident. No generic C_evidence cap is assigned from missing public inputs. Indicative ERS uses normalized ACI = 1.00 for comparison only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.08 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.7 midpoint, interval 1.0–6.4; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2025-64660 CVSS 3.1 Base 8.0 High
| Published score | 8.0 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
| Scored by | Microsoft CNA |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/64xxx/CVE-2025-64660.json (accessed 2026-10-18) |
| Affected component | GitHub Copilot and Visual Studio Code multi-root workspace access control |
| Scope note | Microsoft CNA CVE covers this exact Copilot and VS Code agent workspace path. |
| Source note | The Microsoft CNA record provides an 8.0 Base score and a vector that includes E/RL/RC temporal fields; no separate temporal score is asserted. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
The agent had a nominal workspace write boundary, but changing multi-root folders and settings could extend that boundary and activate an executable path. The AITBM anchor applies only to the stated product and configuration.
Sources: Vendor or maintainer advisory — CVE-2025-64660 · Original IDEsaster researcher case study (2025-12-06)