Rafael routed VS Code through a mitmproxy and spent a week watching what Copilot actually sends and stores. He then confirmed every finding against the open-source VS Code extension codebase. The result is a detailed architecture audit of a tool millions of developers use daily.

Key findings from the reverse engineering:

  • Copilot runs an intent classifier (/models/session/intent) before every request — your prompt gets scored against code-gen, debugging, reasoning, tool-use to decide which model handles it
  • The “recent edits” context window pulls up to 20 files, 8 edit summaries, and 3 lines of context around each change — this is how a fake secret from a .env file ended up in a completion request fired from an unrelated pyproject.toml
  • There is no default .env exclusion rule on individual plans, no .gitignore integration; the only exclusion gate requires a Business/Enterprise GitHub admin policy
  • Copilot’s local session store (session-store.db) records every user message and assistant response in plaintext — no redaction, no sanitization, no masking on the write path. The code does exactly what it says, and what it says stores everything
  • The Chronicle tool lets the model query this database via SQL at runtime, introspecting the schema and recovering from failed queries (a neat example of self-healing tool use)

The broader point is the one that sticks: AI coding tools are becoming stateful systems. They combine workspace content, recent edits, conversation history, tools, and model routing — each new source of context improves usefulness and expands the confidentiality boundary. The differentiation between tools is shifting from “which model” to “how well do they assemble the right context.” The engineering challenge is keeping it lean without prompt bloat. The harder challenge is keeping it safe.