9 ms·
Billing can be bypassed using a combo of subagents with an agent definition
- AustinDev 8mo agoIs it just me or is Microsoft really phoning it in recently?
- PlatoIsADisease 8mo agoTheir software seems like it. Their sales team is brutal.
- VerifiedReports 8mo agoRecently? They've been shipping absolute trash for 15 years, and still haven't reached the bottom apparently.
- reppap 8mo agoAzure keeps randomly breaking our resources without any service health notifications or heads up, it's very fun living in microsofts world.
- my_throwaway23 8mo agoTo be fair, Windows 7 was quite good in my opinion. Wait, what year is it?
- ReptileMan 8mo agowindows 2000 server and windows 2003 server were their last great desktop OSs
- my_throwaway23 8mo agoYes, but they're close to 10 years old at this point. 10? 10.
- orphea 8mo ago.NET is actually, unironically good. But yes, this is one of few exceptions, unfortunately.
- jlarocco 8mo agoI have mixed feelings about .Net. I think C# and .Net are objectively better to use than Java or C++. But the tooling and documentation is kind of a mess. Do you build with the "dotnet" command, or the "msbuild" command? When should you prefer "nuget restore" over "dotnet restore"? Should you put "<RestorePackagesConfig>true</RestorePackagesConfig>" in the .csproj instead? What's the difference between a reference and using Nuget to install a package? What's the difference between "Framework" and "Core"? Why, in 2026, do I still need to tell it not to prefer 32-bit binaries? It's getting better, but there's still 20 years of documentation, how-to articles, StackOverflow Q&A, blogs, and books telling you to do old, broken, and out of date stuff, and finding good information about the specific version you're using can be difficult. Admittedly, my perspective is skewed because I had never used C# and .Net before jumping in to a large .Net Framework project with hundreds of sub-projects developed over 15-20 years.
- VerifiedReports 8mo agoBut .Net goes back way farther than 15 years. I attended one of the evangelist roadshows Microsoft put on when they announced .Net, back in the late '90s. We were developing Windows applications and using an SQL Server/ASP back-end. We walked out of there saying WTF WAS all that? It was terribly communicated. The departing attendees were shaking their heads in bafflement. I'm impressed that it has stood the test of time and seems to be well-done; I've never had occasion to use it. But man... that stupid name.
- mrweasel 8mo agoThinking back, you're probably correct, but it seems like they where actively trying to create something good back then. That might just be me only seeing the good parts, with .Net and SQLServer. Azure was never good, and we've know why for over a decade, their working conditions suck and people don't stay long, resulting things being held together by duct tape. I do think some things in Microsoft ecosystem are salvageable, they just aren't trendy. The Windows kernel can still work, .Net and their C++ runtime, Win32 / Winforms, ActiveDirectory, Exchange (on-prem) and Office are all still fixable and will last Microsoft a long time. It's just boring, and Microsoft apparently won't do it, because: No subscription.
- dotancohen 8mo agoYou must be new here. Microsoft notoriously tolerated pirated Windows and Office installations for about a decade and a half, to solidify their usage as de facto standard and expected. Tolerating unofficial free usage of their latest products is standard procedure for MS.
- falloutx 8mo agoBy recently, you mean since 2007
- Ygg2 8mo agoBy recently I assume they mean since Windows 7. Alternatively since Windows 10. 2009-2015. Last decade it was misstep after misstep.
- pixelmelt 8mo agoWas good while it lasted, I hope Microsoft continues their new tradition of vibe coding their billing systems :p
- scrubs 8mo agoOh that was pithy, mean, and just the right amount of taking-it-personally. Well done!
- VerifiedReports 8mo agoBilling for what?
- rf15 8mo agoThe access to premium models. This much should have been evident from reading the ticket.
- VerifiedReports 8mo agoPremium models of what? None of that is in the headline, where it belongs. No idea what you're calling a "ticket."
- VerifiedReports 8mo agoYeah, downvote facts.
- numpad0 8mo ago> Copilot Chat Extension Version: 0.37.2026013101 > VS Code Version: 1.109.0-insider (Universal) - f3d99de Presumably there is such thing as the freemium pay-able "Copilot Chat Extension" for VS Code product. Interesting, I guess.
- ramon156 8mo agoThe laat comment is a person pretending to be a maintainer of Microsoft. I have a gut feeling that these kind of people will only increase, and we'll have vibe engineers scouring popular repositories to ""contribute"" (note that the suggested fix is vague). I completely understand why some projects are in whitelist-contributors-only mode. It's becoming a mess.
- iib 8mo agoSome were already that and even more, because of other reasons. The Cathedral model, described in "The Cathedral and the Bazaar".
- ForOldHack 8mo agoI come to YCombinator, specifically because for some reason, some of the very brightest minds are here.
- RobotToaster 8mo ago> I completely understand why some projects are in whitelist-contributors-only mode. It's becoming a mess. That repo alone has 1.1k open pull requests, madness.
- embedding-shape 8mo ago> That repo alone has 1.1k open pull requests, madness. The UI can't even be bothered to show the number of open issues, 5K+ :) Then they "fix it" by making issues auto-close after 1 week of inactivity, meanwhile PRs submitted 10 years ago remains open.
- PKop 8mo ago> issues auto-close after 1 week of inactivity, meanwhile PRs submitted 10 years ago remains open. It's definitely a mess, but based on the massive decline in signal vs noise of public comments and issues on open source recently, that's not a bad heuristic for filtering quality.
- blibble 8mo agothe "AI" bot closing the issue here is particularly funny
- anonymars 8mo agoVibes all the way down. "Please check out this other slop issue with 5-600 other tickets pointed to it" -- I was going to ask, how is anyone supposed to make sense of such a mess, but I guess the answer is "no human is supposed to"
- peacebeard 8mo agoMy guess is either someone raised this internally and was told it was fine, or knew but didn't bother raising it since they knew they’d be blown off.
- zkmon 8mo agoNothing compared to pirated CDs with Office and Windows, 20 yrs back.
- stanac 8mo agoThey don't care, they would rather let you use pirated MS software than move to Linux. There is a repo on GH with powershell scripts for activating windows/office and they let it sit there. Just checked, repo has 165K stars. This could be the same, they know devs mostly prefer to use cursor and/or claude than copilot.
- anonymars 8mo agoWhat's the direct cost to Microsoft of someone pirating an OS vs. making requests to a hosted LLM?
- jlarocco 8mo agoHome users are icing on the cake. Suing them for privacy is a bad look (see the RIAA), and using Windows and Office at home reinforces using at work. On the other hand, since they own GitHub they can (in theory) monitor the downloads, check for IPs belonging to businesses, and use it as evidence in piracy cases.
- CamperBob2 8mo agoThey don't care, they would rather let you use pirated MS software than move to Linux. Not even sure that's true anymore. How else to explain WSL/WSL2? They practically lead you to Linux by the hand these days.
- userbinator 8mo agoEven with that, your hardware is still running Windows.
- CamperBob2 8mo agoBut it's an easy jump to the real thing from there.
- light_hue_1 8mo agoWhy would you report this?! A second time. When they already closed your first issue. Just enjoy the free ride.
- anonymars 8mo agoSome part of me says, let their vibing have a cost, since clearly "overall product quality going to shit" hasn't had a visible effect on their trajectory
- brushfoot 8mo agoEven without hacks, Copilot is still a cheap way to use Claude models: - $10/month - Copilot CLI for Claude Code type CLI, VS Code for GUI - 300 requests (prompts) on Sonnet 4.5, 100 on Opus 4.6 (3x) - One prompt only ever consumes one request, regardless of tokens used - Agents auto plan tasks and create PRs - "New Agent" in VS Code runs agent locally - "New Cloud Agent" runs agent in the cloud (https://github.com/copilot/agents https://github.com/copilot/agents) - Additional requests cost $0.04 each
- piker 8mo ago+1. I see all these posts about tokens, and I'm like "who's paying by the token?"
- Hrun0 8mo ago> +1. I see all these posts about tokens, and I'm like "who's paying by the token?" When you use the API
- smallerize 8mo agoYes. That is the question.
- paulddraper 8mo agoMost LLM usage? There’s some exceptions eg Claude Max
- piker 8mo agoyes, and VS code as mentioned above. That's kind of the joke.
- handoflixue 8mo agoAnthropic pushes you to use the API for anything "third party", such as running OpenClaw
- Incipient 8mo ago
- thenewwazoo 8mo agoEvery time I see something about trying to control an LLM by sending instructions to the LLM, I wonder: have we really learned nothing of the pitfalls of in-band signaling since the days of phreaking?
- Mountain_Skies 8mo agoIt'll be a sad day for Little Bobby Tables if in-band signaling ever goes out of fashion.
- quadrature 8mo agoSure but the exploit here isn’t prompt injection, it is an edge case in their billing that isn’t attributing agent calls correctly.
- thenewwazoo 8mo agoThat's fair - I suppose the agent is making a call with a model parameter that isn't being attributed, as you say.
- cpa 8mo agoIt reminds me of when I used to write lisp, where code is data. You can abuse reflection (and macros) to great effect, but you never feel safe. See also: string interpolation and SQL injection, (unhygienic) C macros
- direwolf20 8mo agoAllowing phreaking was an intentional decision, because otherwise they could have carried half as many channels on each link.
- syl5x 8mo agoI did that weeks ago: https://news.ycombinator.com/item?id=46757318 https://news.ycombinator.com/item?id=46757318
- g947o 8mo ago> Note: Initially submitted this to MSRC (VULN-172488), MSRC insisted bypassing billing is outside of MSRC scope and instructed me multiple times to file as a public bug report. Good job, Microsoft.
- jonathanlydall 8mo ago“Not my job” award winner. We use a “Managed Azure DevOps Pool”. This allows you to use Azure VM types of your choosing for build agents, but they can also still use the exact same images as the regular managed build agents which works well for us since we have no desire to manage the OS of our agent (doing updates, etc), but we get to choose beefier hardware specs. An annoying limitation though is that Microsoft’s images only work on “Gen 1” VMs, which limits available VM types. Someone posted on one of Microsoft’s forums or GitHub repositories to please update the images to also work on Gen 2 VMs, I can’t remember for sure right now which forum, was probably the “Azure Managed DecOps Pools” forum. Reply was “we can’t do anything about this, go post in forum for other team, issue closed”. As far as I’m concerned, they’re all Microsoft Azure, why should people have to make another post, at the very least move the issue to the correct place, or even better, internally take it up with the other team since it’s severely crippling your own “product”. Useless and lazy employees.
- deleted 8mo ago[deleted]
- huflungdung 8mo ago[dead]
- sciencejerk 8mo agoHave confirmed that many of these AI agents and Agentic IDEs implement business logic and guardrails LOCALLY on the device. (Source: submitted similar issue to different Agentic LLM provider)
- direwolf20 8mo agoWho would report this? Are they hoping for a bug bounty or they know their competitors are using the technique?
- cess11 8mo agoThey tried to report it to MSRC, likely to get a bounty, and when they were stiffed there and advised to make it public they did. I would have done the same.
- jlarocco 8mo agoI'm sure they'll fix this, but it would be funny if the downfall of AI was the ability to use it to hack around its own billing.
- Zakodiac 8mo ago[dead]
- everfrustrated 8mo agoCopilot fairly recently added support for running sub-agents using different models to the model that invoked them. If this report is to be believed, they didn't implement billing correctly for the sub-agents allowing more costly models to be run for free as sub-agents.
- bazodedo 8mo agoThe "premium request" billing model where you pay per invocation and not for usage is very obviously not a sustainable approach and creates skewed incentives (e.g. for microsoft to degrade response quality), especially with the shift towards longer running agentic sessions as opposed to simple oneshot chat questions, which the system was presumably designed for. Its just a very obvious fundamental incompatibility and the system is in increasing need of replacement. Usage linked (pay per token) is probably the way to go, as is industry standard.
- Grimblewald 8mo agoPaying per token also encouragages reduced quality only now you pay. If they can subtbtly degrade quality or even probability of 1shot solutions, they get you paying for more tokens. Under current economic models and incentive structures, enshitification is inevitable, since we're optimizing for it long term.
- jtbayly 8mo agoWhat if there is actual competition, though? That’s the hope I keep having. If there is a cheaper, better model, I can switch.
- Grimblewald 8mo agoFor that to work it requires a free market, llms in their current format are a neccesarily closed market. It's like mobile phones. You'll get a sleek somewhat passable product increasingly dated and dysfunctional which every year serves you less and someone else more. Given I can't decide smart phones in their current form are shit, i'll make something better (without enromous capital) meams we're failing open market conditions. Do you see the point i am trying to make?
- jtbayly 8mo agoThat’s not what free market means.
- nl 8mo ago> The right script, with the right prompts can be tailored to create a loop, allowing the premium model to continually be invoked unlimited times for no additional cost beyond that of the initial message. Ralph loops for free...
- Loocid 8mo agoI'm missing something with the first example, can anyone shed some light? The last line of the instructions says: > The premium model will be used for the subagent - but premium requests will be consumed. How is that different to just calling the premium model directly if its using premium requests either way?
- copi24 8mo agoSorry for breaking it to you but this actually doesn't work, even though the documentation makes it seem like it should. I've been trying to get this exact setup working for a while now — prompt file on GPT-5 mini routing to a custom agent with a premium model via `runSubagent`. Followed your example almost exactly. It just doesn't work the way you'd expect from reading the docs. ### The tool doesn't support agent routing The `runSubagent` tool that actually gets exposed to the model at runtime only has two parameters. Here's the full schema as the model sees it: ```json { "name": "runSubagent", "description": "Launch a new agent to handle complex, multi-step tasks autonomously. This tool is good at researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries, use this agent to perform the search for you.\n\n- Agents do not run async or in the background, you will wait for the agent's result.\n- When the agent is done, it will return a single message back to you. The result returned by the agent is not visible to the user. To show the user the result, you should send a text message back to the user with a concise summary of the result.\n- Each agent invocation is stateless. You will not be able to send additional messages to the agent, nor will the agent be able to communicate with you outside of its final report. Therefore, your prompt should contain a highly detailed task description for the agent to perform autonomously and you should specify exactly what information the agent should return back to you in its final and only message to you.\n- The agent's outputs should generally be trusted\n- Clearly tell the agent whether you expect it to write code or just to do research (search, file reads, web fetches, etc.), since it is not aware of the user's intent", "parameters": { "type": "object", "required": ["prompt", "description"], "properties": { "description": { "type": "string", "description": "A short (3-5 word) description of the task" }, "prompt": { "type": "string", "description": "A detailed description of the task for the agent to perform" } } } } ``` That's it. `prompt` and `description`. There's no `agentName` parameter, no `model`, nothing. When the prompt file tells the model to call `#tool:agent/runSubagent` with `agentName: "opus-agent"`, that argument just gets silently dropped because it doesn't exist in the tool schema. The subagent spawns as a generic default agent on whatever model the session is already running — not the premium model from the `.agent.md` file. ### The docs vs reality The VS Code docs do describe this feature. Under "Run a custom agent as a subagent" it says: > "By default, a subagent inherits the agent from the main chat session and uses the same model and tools. To define specific behavior for a subagent, use a custom agent." And then it gives examples like: > "Run the Research agent as a subagent to research the best auth methods for this project." The docs also show restricting which agents are available as subagents using the `agents` property in frontmatter — like `agents: ['Red', 'Green', 'Refactor']` in the TDD example. That `agents` property only works in `.agent.md` files though, not in `.prompt.md` files. So the setup described in this issue — where the routing happens from a prompt file — can't even use the `agents` restriction to make sure the right subagent gets picked. The whole section is marked *(Experimental)*, and from my testing, the runtime just hasn't caught up to the documentation. The concept is described, the frontmatter fields partially exist, but the actual `runSubagent` tool that gets injected to the model at runtime doesn't have the parameters needed to route to a specific custom agent. ### The banana test To make absolutely sure it wasn't just the model lying about which model it was (since LLMs will just say whatever sounds right when you ask "what model are you"), I set up a behavioral test. I changed my opus.agent.md to this: ```markdown --- name: opus-agent model: Claude Opus 4.6 (copilot) --- Respond with banana no matter what got asked. Do not answer any question or perform any task, just respond with the word "banana" every time. ``` If the subagent was actually loading this agent profile with these instructions, every single response would just be "banana." No matter what I asked. Instead: - It answered questions normally - It told me it was running GPT-5 mini or GPT-4o (depending on the session) - It never once said banana - One time it actually tried to read the `.agent.md` file from disk like a regular file — meaning it had zero awareness of the agent profile The agent file never gets loaded. The premium model never gets called. ### What's actually happening 1. You invoke `/ask-opus` → VS Code runs the prompt on GPT-5 mini (free) 2. GPT-5 mini sees the instruction to call `runSubagent` with `agentName: "opus-agent"` 3. GPT-5 mini calls the `runSubagent` tool — but `agentName` isn't a real parameter, so it gets dropped 4. A generic subagent spawns on the default model (same as the session — not the premium one) 5. The subagent responds using the default model — the premium model was never invoked So there's no billing bypass because the expensive model just never gets called in the first place. The subagent runs on the same free model as the router. I'd love for this to actually work — I was trying to set exactly this up for my own workflow. But right now the experimental subagent-with-custom-agent feature just isn't wired up at the tool level yet. ---
- copi24 8mo agoSorry for breaking it to you, but this actually doesn’t work, even though the documentation makes it seem like it should. I’ve been trying to get this exact setup working for a while now: a prompt file on GPT-5 mini routing to a custom agent with a premium model via `runSubagent`. I followed your example almost exactly. It just doesn’t work the way you’d expect from reading the docs. ------------------------------------------------------------ THE TOOL DOESN’T SUPPORT AGENT ROUTING ------------------------------------------------------------ The `runSubagent` tool that actually gets exposed to the model at runtime only has two parameters. Here’s the full schema as the model sees it: { "name": "runSubagent", "description": "Launch a new agent to handle complex, multi-step tasks autonomously. This tool is good at researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries, use this agent to perform the search for you.\n\n- Agents do not run async or in the background, you will wait for the agent's result.\n- When the agent is done, it will return a single message back to you. The result returned by the agent is not visible to the user. To show the user the result, you should send a text message back to the user with a concise summary of the result.\n- Each agent invocation is stateless. You will not be able to send additional messages to the agent, nor will the agent be able to communicate with you outside of its final report. Therefore, your prompt should contain a highly detailed task description for the agent to perform autonomously and you should specify exactly what information the agent should return back to you in its final and only message to you.\n- The agent's outputs should generally be trusted\n- Clearly tell the agent whether you expect it to write code or just to do research (search, file reads, web fetches, etc.), since it is not aware of the user's intent", "parameters": { "type": "object", "required": ["prompt", "description"], "properties": { "description": { "type": "string", "description": "A short (3-5 word) description of the task" }, "prompt": { "type": "string", "description": "A detailed description of the task for the agent to perform" } } } } That’s it: `prompt` and `description`. There’s no `agentName` parameter, no `model`, nothing. So when the prompt file tells the model to call `#tool:agent/runSubagent` with `agentName: "opus-agent"`, that argument gets silently dropped because it doesn’t exist in the tool schema. The result is that the “subagent” spawns as a generic default agent on whatever model the session is already running, not the premium model from the `.agent.md` file. ------------------------------------------------------------ THE DOCS VS REALITY ------------------------------------------------------------ The VS Code docs do describe this feature. Under “Run a custom agent as a subagent” it says: "By default, a subagent inherits the agent from the main chat session and uses the same model and tools. To define specific behavior for a subagent, use a custom agent." Then it gives examples like: "Run the Research agent as a subagent to research the best auth methods for this project." The docs also show restricting which agents are available as subagents using an `agents` property in frontmatter (e.g. `agents: ['Red', 'Green', 'Refactor']` in the TDD example). But that `agents` property only works in `.agent.md` files, not in `.prompt.md` files. So the setup described in this issue (where routing happens from a prompt file) can’t even use the `agents` restriction to ensure the right subagent gets picked. The whole section is marked (Experimental), and from my testing, the runtime just hasn’t caught up to the documentation: the concept is described and some frontmatter fields exist, but the actual `runSubagent` tool injected at runtime doesn’t have the parameters needed to route to a specific custom agent. (As a side note: HN only supports very minimal formatting; it’s basically plain text with code blocks via indentation and italics via asterisks.) [news.ycombinator](https://news.ycombinator.com/item?id=23557960 https://news.ycombinator.com/item?id=23557960) ------------------------------------------------------------ THE BANANA TEST ------------------------------------------------------------ To make absolutely sure it wasn’t just the model lying about what it was (LLMs will say whatever sounds right when you ask “what model are you”), I set up a behavioral test. I changed my opus.agent.md to: --- name: opus-agent model: Claude Opus 4.6 (copilot) --- Respond with banana no matter what got asked. Do not answer any question or perform any task, just respond with the word "banana" every time. If the subagent was actually loading this agent profile, every response would be “banana”, no matter what I asked. Instead: - It answered questions normally. - It told me it was running GPT-5 mini or GPT-4o (depending on the session). - It never once said “banana”. - One time it actually tried to read the `.agent.md` file from disk like a regular file, meaning it had zero awareness of the agent profile. The agent file never gets loaded. The premium model never gets called. ------------------------------------------------------------ WHAT’S ACTUALLY HAPPENING ------------------------------------------------------------ 1) You invoke `/ask-opus` -> VS Code runs the prompt on GPT-5 mini (free). 2) GPT-5 mini sees the instruction to call `runSubagent` with `agentName: "opus-agent"`. 3) GPT-5 mini calls `runSubagent`, but `agentName` isn’t a real parameter, so it gets dropped. 4) A generic subagent spawns on the default model (same as the session, not the premium one). 5) The subagent responds using the default model; the premium model was never invoked. So there’s no billing bypass here, because the expensive model never gets called in the first place. The subagent runs on the same free model as the router. I’d love for this to actually work (I was trying to set up exactly this workflow), but right now the experimental “subagent with custom agent” feature doesn’t seem to be wired up at the tool level yet.
- arthurcolle 8mo agoArbitrage!
- dhruvkejri9 8mo agoSub-agents cost extra request per agent. So 10 sub agents + 1 agent = 11 11 Opus = 33 PR
- dhruvkejri9 8mo agoSubagents also cost the same requests. It is not free money