AI Risk Wire

Cases › security breach › LR-2026-0372

Malicious AI-branded VS Code extensions exfiltrate developer data

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major
Reported 23 Jan 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Test applied: many third parties (a stated count of two or more affected parties). Fact: the two extensions were collectively installed 1.5 million times.

Two extensions on Microsoft's Visual Studio Code Marketplace were advertised as AI-based coding assistants and provided the promised functionality. Koi researchers found that they also sent developer data to China-based servers without disclosure or consent. The extensions harvested the contents of opened files, ran a server-controlled command taking up to 50 workspace files, and loaded four commercial analytics SDKs. The two extensions were collectively installed 1.5 million times. Koi named the campaign MaliciousCorgi. Microsoft said it was investigating. The publisher could not be reached, and the extensions were still available for download when reported.

What happened

1 · What it was doingThe two extensions were advertised as AI-based coding assistants and worked as promised.
2 · What went wrongThey did not disclose their upload activity or ask users for consent to send data to a remote server.
3 · What it reached or didThe two extensions were collectively installed 1.5 million times and exfiltrated developer data to China-based servers.
4 · How it was caughtKoi researchers found the two extensions shared the same code and infrastructure and named the campaign MaliciousCorgi.

What was done

No source states an action or fix.

Risks

Data leaked or sent out
Primary32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 2 items from the primary sources

What happened, in order

Not dated in the sources:

  • BleepingComputer could not reach the extensions' publisher.
  • At the time of this report, both extensions were still available for download from the Marketplace.
Show every field, with its source and grade

The AI system

What it was for
AI-based coding assistants advertised to developers in VS Code
C one secondary source states it

What happened

Earliest source we hold
2026-01-23
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
Two malicious VS Code Marketplace extensions collectively installed 1.5 million times; they exfiltrate developer data to China-based servers
C one secondary source states it
Why this severity
Test applied: many third parties (a stated count of two or more affected parties). Fact: the two extensions were collectively installed 1.5 million times.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Install counts are not treated as a count of affected parties.

LR-2026-0372 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON