Billing can be bypassed using a combo of subagents with an agent definition

Even without hacks, Copilot is still a cheap way to use Claude models:

- $10/month

- Copilot CLI for Claude Code type CLI, VS Code for GUI

- 300 requests (prompts) on Sonnet 4.5, 100 on Opus 4.6 (3x)

- One prompt only ever consumes one request, regardless of tokens used

- Agents auto plan tasks and create PRs

- "New Agent" in VS Code runs agent locally

- "New Cloud Agent" runs agent in the cloud (https://github.com/copilot/agents)

- Additional requests cost $0.04 each

> Note: Initially submitted this to MSRC (VULN-172488), MSRC insisted bypassing billing is outside of MSRC scope and instructed me multiple times to file as a public bug report.

Good job, Microsoft.

The "premium request" billing model where you pay per invocation and not for usage is very obviously not a sustainable approach and creates skewed incentives (e.g. for microsoft to degrade response quality), especially with the shift towards longer running agentic sessions as opposed to simple oneshot chat questions, which the system was presumably designed for. Its just a very obvious fundamental incompatibility and the system is in increasing need of replacement. Usage linked (pay per token) is probably the way to go, as is industry standard.

> The right script, with the right prompts can be tailored to create a loop, allowing the premium model to continually be invoked unlimited times for no additional cost beyond that of the initial message.

Ralph loops for free...

I did that weeks ago: https://news.ycombinator.com/item?id=46757318

Have confirmed that many of these AI agents and Agentic IDEs implement business logic and guardrails LOCALLY on the device.

(Source: submitted similar issue to different Agentic LLM provider)

The laat comment is a person pretending to be a maintainer of Microsoft. I have a gut feeling that these kind of people will only increase, and we'll have vibe engineers scouring popular repositories to ""contribute"" (note that the suggested fix is vague).

I completely understand why some projects are in whitelist-contributors-only mode. It's becoming a mess.

Copilot fairly recently added support for running sub-agents using different models to the model that invoked them.

If this report is to be believed, they didn't implement billing correctly for the sub-agents allowing more costly models to be run for free as sub-agents.

My guess is either someone raised this internally and was told it was fine, or knew but didn't bother raising it since they knew they’d be blown off.

Why would you report this?!

A second time. When they already closed your first issue. Just enjoy the free ride.

Who would report this? Are they hoping for a bug bounty or they know their competitors are using the technique?

Nothing compared to pirated CDs with Office and Windows, 20 yrs back.

the "AI" bot closing the issue here is particularly funny

Is it just me or is Microsoft really phoning it in recently?

I'm sure they'll fix this, but it would be funny if the downfall of AI was the ability to use it to hack around its own billing.

Every time I see something about trying to control an LLM by sending instructions to the LLM, I wonder: have we really learned nothing of the pitfalls of in-band signaling since the days of phreaking?

Billing for what?

Was good while it lasted, I hope Microsoft continues their new tradition of vibe coding their billing systems :p

[dead]

[dead]