A critical vulnerability in Microsoft's VS Code Copilot extension allows users to bypass premium billing through a clever combination of subagents and agent definitions. The exploit leverages how Copilot calculates request costs based on the initial model used, enabling unlimited free access to expensive premium models like Opus 4.5. Security researcher Angry-Orangutan discovered that by starting with a free model like GPT-5 Mini and then creating subagents configured with premium models, users can effectively get premium responses without consuming premium credits.

The technique works because subagent tool calls don't count as requests, and the initial model selection determines the billing tier. By orchestrating the conversation flow correctly, users can have the free model launch subagents that use premium models for actual processing. In testing, a single message triggered a 3-hour process that launched hundreds of Opus 4.5 subagents while only consuming 3 premium credits.

Microsoft's Security Response Center initially declined to address the issue, stating billing bypass falls outside their scope and directing the researcher to file a public bug report instead. The vulnerability affects VS Code Copilot Chat Extension version 0.37.2026013101 running on VS Code 1.109.0-insider with OS X Tahoe 26.3. The researcher provided detailed proof-of-concept examples demonstrating how to structure prompts and agent definitions to exploit this billing loophole, raising serious questions about Copilot's request validation and cost calculation mechanisms.