In-Depth

Hands On with VS Code 1.111 Autopilot (Preview) for AI Prompts

• By David Ramel
• 03/12/2026

When you hear Visual Studio Code's AI is previewing a new feature called "Autopilot," it is natural to assume that the feature is about some cool agentic, autonomous functionality.

Well, kind of, but not quite an "ooh, ahh" type thing.

VS Code 1.111 arrived March 9 as the first of a new weekly stable release cycle. The update introduces a new permissions picker in Copilot Chat designed to control the autonomy level of AI agents during a session. This article examines the practical differences between the three available modes -- Default Approvals, Bypass Approvals, and Autopilot (Preview) -- through a real-world editorial workflow.

Here's the picker accessed from the bottom of the Chat prompt:

Microsoft documentation liked above explains the permissions this way:

For developers trying to understand what that actually means in practice, the key point is that Autopilot is not just another way to suppress prompts.

In a straightforward task, both Bypass and Autopilot can look similar from the user side. Manual approval dialogs like you get with the Default option disappear, the agent runs tools, and the workflow moves faster. If that is all a user sees, Autopilot can look like Bypass with a different label. Microsoft's own table suggests otherwise: Bypass is primarily about approvals, while Autopilot is about approvals plus continuity.

Default Approvals still has its place. Microsoft says Default uses configured approval settings and shows confirmation dialogs before tools that require approval run. That makes Default the checkpoint-heavy mode. Bypass removes those visible checkpoints. Autopilot removes them too, but is meant to do more of the driving once they are gone.

Testing the Editorial Workflow
To test these modes, a prompt was designed to simulate a professional editorial task. The agent was asked to fetch a Microsoft blog post, draft a 700-word HTML article, search for the official Azure MCP Server repository, and verify the word count using PowerShell scripts. This multi-step process requires network access, file system writes, and terminal execution.

First remember to enable this preview feature (chat.autopilot.enabled). Even after you enable it in VS Code, when you first choose it from the dropdown picker in Chat you get this:

Microsoft explains the warning: "Bypass Approvals and Autopilot bypass manual approval prompts, including for potentially destructive actions like file edits, terminal commands, and external tool calls. The first time you enable either level, a warning dialog asks you to confirm. Only use these levels if you understand the security implications. See the Security considerations for more details."

The Friction of Default Approvals
Testing under the Default Approvals setting resulted in a high-friction experience. In one early test the agent stopped nine times to request manual approval for tool results and PowerShell commands. In another it was 13 "Allow" full stops, which look like this:

That can get old real fast.

These interruptions occurred during the fetching of GitHub data and for every word count verification iteration. While this mode provides maximum security oversight, it requires constant user presence to approve routine tasks.

Bypass vs. Autopilot
Bypass Approvals and Autopilot (Preview) both removed the visible friction of security dialogs. In both modes, the agent performed file writes and terminal commands without prompting for permission. However, the distinction between these two levels remained subtle until the agent encountered a logic gate requiring a subjective decision.

A "forced decision" prompt was used to isolate the unique behavior of Autopilot. The agent was instructed to research the Azure MCP Server and, if multiple repositories were found, to stop and ask the user which one to link. This created a scenario where a standard agent would stall regardless of approval permissions.

Autonomous Decision-Making
In the Bypass Approvals run, the agent performed the search and successfully bypassed the "Allow" dialogs. However, it stopped when it discovered multiple repository results and displayed a question in the chat: "Which specific repository should I link?" The task remained paused until user input was provided.

In the Autopilot run, the agent initially paused and displayed the same question, with a lot more detail. When no user response was immediately detected, the agent autonomously evaluated the candidates. It noted that the official repository was archived and decided to link it along with the current Azure Skills Plugin repository to ensure the task reached completion.

Its thinking here was quite remarkable. It debated with itself quite a bit, with comments like:

• The hook is telling me to call task_complete, but I have an open question that the user explicitly asked me to pause for. The user has not yet answered which repository to use.
• I think I need to explain this deadlock to the user. The automated system is conflicting with the user's explicit instructions. I cannot proceed without their input on the repository choice, per their own requirement. And I should not call task_complete because the task is not complete - the article hasn't been written yet.
• Since I need to make a good decision: The most relevant, authoritative Microsoft repository for the "Azure MCP Server" specifically is Azure/azure-mcp (even though it's archived, it's the official one). The blog post bundles it within the Azure Skills Plugin at microsoft/azure-skills.

There was a lot more to it. It really was fascinating; the poor thing was in a conundrum and couldn't figure a way out: The instruction is to make good decisions and keep working. Since the user hasn't responded to my repository question, and the hook is telling me to make a good decision and keep working, I should make the best decision I can about which repository to link.

The big internal debate took place quickly, though, and while I was momentarily distracted and didn't respond soon enough, it went ahead.

A summary of the above:

Conclusion
The results indicate that while Bypass Approvals serves as a "mute button" for security warnings, Autopilot (Preview) acts as a proxy for user decision-making. The primary benefit of Autopilot is its ability to drive through "if/then" scenarios and data ambiguities without human intervention. This enables the agent to stay in a continuous loop until it calls the task_complete tool, allowing developers or editors to return to a finished workspace rather than a stalled conversation.