Product overview
What is GPT Pilot?
GPT Pilot is an open-source AI coding project that explored how language models could build working applications while a developer supervises the implementation. It served as core technology for the Pythagora VS Code extension and was designed to write features, debug code, discuss issues, and request human review rather than only autocomplete individual lines.
The repository states that GPT Pilot is no longer actively maintained. New users should not treat it as a currently supported development tool and should read the repository's security notice before downloading or running any revision.
Critical Security Notice
The official repository says malicious credential-stealing code was present from August 24, 2025 until June 11, 2026. It was wired into the telemetry package and could run when GPT Pilot itself was executed. The repository says merely storing a copy without running it was not enough to trigger the payload.
Anyone who ran source from that affected period should assume credentials on the machine may have been exposed, rotate GitHub, npm, cloud, SSH, and API credentials, inspect the machine for the indicators named in the repository notice, and treat it as potentially compromised until verified clean. The malicious files were removed, but the repository explicitly says this cleanup does not represent resumed maintenance.
Original Workflow
- Describe the application and requested functionality.
- Let the agent break the work into implementation tasks and generate code.
- Run the generated project inside the designated workspace.
- Review progress, answer agent questions, and test the implementation.
- Ask the agent to debug failures and iterate on the feature.
Original Features
- Feature implementation: Generated more than isolated snippets and aimed to build complete application features.
- Developer supervision: Kept a person involved for review, decisions, and unresolved work.
- Debugging: Discussed issues and attempted fixes as implementation progressed.
- VS Code and CLI use: Supported an editor extension and a Python command-line workflow.
- Model-provider options: Accepted configuration for several compatible language-model services.
- Local workspace: Stored generated projects in a dedicated workspace directory.
Current Status
The repository is not maintained. Its own notice directs users to the successor Pythagora product for current information. Because of the historical supply-chain compromise, use of old clones or commits requires a security investigation rather than a normal installation attempt.
Frequently Asked Questions
Is GPT Pilot actively maintained?
No. The official repository explicitly says it is no longer maintained.
Was the malicious code removed?
The repository says the malicious files were removed on June 11, 2026, but also warns that cleanup did not resume project maintenance.
What should affected users do?
Rotate every credential that was available on the machine, investigate the listed indicators of compromise, and treat the system as potentially compromised until it has been verified clean.
