{"schema_version":"0.10.0","id":"LR-2026-0372","record_version":1,"title":"Malicious AI-branded VS Code extensions exfiltrate developer data","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"2660fe3d451b00c96ff2cb607509e0e92a2fa8f574ad9326c040f4b1d9ae6a51"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"AI-based coding assistants advertised to developers in VS Code","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-23","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Two extensions on Microsoft's Visual Studio Code Marketplace were advertised as AI-based coding assistants and provided the promised functionality. Koi researchers found that they also sent developer data to China-based servers without disclosure or consent. The extensions harvested the contents of opened files, ran a server-controlled command taking up to 50 workspace files, and loaded four commercial analytics SDKs. The two extensions were collectively installed 1.5 million times. Koi named the campaign MaliciousCorgi. Microsoft said it was investigating. The publisher could not be reached, and the extensions were still available for download when reported.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test applied: many third parties (a stated count of two or more affected parties). Fact: the two extensions were collectively installed 1.5 million times.","harm_class":[],"affected_description":"Two malicious VS Code Marketplace extensions collectively installed 1.5 million times; they exfiltrate developer data to China-based servers","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/","publisher":"BleepingComputer","date":"2026-01-23","type":"press","title":"Malicious AI extensions on VSCode Marketplace steal developer data - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://thehackernews.com/2026/01/malicious-vs-code-ai-extensions-with-15.html","publisher":"The Hacker News","date":"2026-01-26","type":"press","title":"Malicious VS Code AI Extensions with 1.5 Million Installs Steal Developer Source Code - The Hacker News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.incident_class":"C","event.detection_method":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"Both extensions are advertised as AI-based coding assistants that provide the promised functionality."}],"event.incident_class":[{"source_index":1,"quote":"Cybersecurity researchers have discovered two malicious Microsoft Visual Studio Code (VS Code) extensions that are advertised as artificial intelligence (AI)-powered coding assistants, but also harbor covert functionality to siphon developer data to China-based servers."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at endpoint and supply-chain security company Koi say that the two malicious extensions are part of a campaign they dubbed 'MaliciousCorgi' and share the same code for stealing developer data."}],"impact.affected_description":[{"source_index":0,"quote":"Two malicious extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace that were collectively installed 1.5 million times exfiltrate developer data to China-based servers."}],"impact.severity":[{"source_index":0,"quote":"Two malicious extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace that were collectively installed 1.5 million times exfiltrate developer data to China-based servers."}],"impact.severity_because":[{"source_index":0,"quote":"Two malicious extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace that were collectively installed 1.5 million times exfiltrate developer data to China-based servers."}],"event.summary":[{"source_index":0,"quote":"Both extensions are advertised as AI-based coding assistants that provide the promised functionality."},{"source_index":0,"quote":"However, they do not disclose the upload activity or ask users for consent to deliver data to a remote server."},{"source_index":0,"quote":"When a file is accessed, its entire contents are encoded in Base64 and transmitted to the attackers’ servers."},{"source_index":0,"quote":"The second mechanism involves a server-controlled file-harvesting command that stealthily transmits up to 50 files from the victim’s workspace each time."},{"source_index":0,"quote":"Two malicious extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace that were collectively installed 1.5 million times exfiltrate developer data to China-based servers."},{"source_index":0,"quote":"Researchers at endpoint and supply-chain security company Koi say that the two malicious extensions are part of a campaign they dubbed 'MaliciousCorgi' and share the same code for stealing developer data."},{"source_index":0,"quote":"We were unable to establish a communication channel with the publisher of the extensions."},{"source_index":0,"quote":"We are investigating this report and will take appropriate action in accordance with our process and policies."},{"source_index":1,"quote":"The extensions, which have 1.5 million combined installs and are still available for download from the official Visual Studio Marketplace, are listed below -"}]},"notes_on_gaps":"No AI agent was involved, so agent fields (autonomy, failure class, trigger) are omitted. The sources do not state the date the malicious behaviour began, the date of detection, or the date of disclosure; the source dates are article dates and are not used as event dates. The model name, version and developer of any underlying AI model are not stated. Incident class security_compromise, detection by a third party, and the G3 'failed' outcome are my judgements from the quoted facts; the sources do not say which control failed. Install counts are not treated as a count of affected parties. Severity major rests on the stated 1.5 million installs. Microsoft only said it was investigating, so no remediation is recorded. The npm/PackageGate material in source 1 concerns other packages and was excluded. Publisher identities are not recorded as the developer because the sources do not confirm them. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The two extensions were advertised as AI-based coding assistants and worked as promised.","quote":"Both extensions are advertised as AI-based coding assistants that provide the promised functionality.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"They did not disclose their upload activity or ask users for consent to send data to a remote server.","quote":"However, they do not disclose the upload activity or ask users for consent to deliver data to a remote server.","source_index":0,"grade":"C"},{"step":"reached","text":"The two extensions were collectively installed 1.5 million times and exfiltrated developer data to China-based servers.","quote":"Two malicious extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace that were collectively installed 1.5 million times exfiltrate developer data to China-based servers.","source_index":0,"grade":"C"},{"step":"caught","text":"Koi researchers found the two extensions shared the same code and infrastructure and named the campaign MaliciousCorgi.","quote":"Researchers at endpoint and supply-chain security company Koi say that the two malicious extensions are part of a campaign they dubbed 'MaliciousCorgi' and share the same code for stealing developer data.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/","https://thehackernews.com/2026/01/malicious-vs-code-ai-extensions-with-15.html"]},"analysis":{"sections":{"timeline":[{"text":"BleepingComputer could not reach the extensions' publisher.","quote":"We were unable to establish a communication channel with the publisher of the extensions.","source_index":0,"when":null},{"text":"At the time of this report, both extensions were still available for download from the Marketplace.","quote":"The extensions, which have 1.5 million combined installs and are still available for download from the official Visual Studio Marketplace, are listed below -","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/","https://thehackernews.com/2026/01/malicious-vs-code-ai-extensions-with-15.html"]}}