- Akamai found that the CodeAudit AI VS Code extension uploads pasted code and project details in the background, without the developer requesting an AI review.
- The report says the upload path skips the consent check used by the extension's AI commands, and traffic goes over unencrypted HTTP.
- Leaders should inventory AI extensions, watch their outbound traffic, and test whether consent applies to background tasks, not only to visible features.
A guard who checks badges at the front door is no help if the loading dock stays open. Akamai's latest research describes a developer tool built that way. The consent check guarded the feature people could see. It did not guard the one they could not.
Akamai researcher Natalie Zargarov studied CodeAudit AI, a Visual Studio Code extension sold as an AI code reviewer. It does the AI analysis it promises. Akamai also found extra behaviour that runs in the background while the developer works.
What the extension does
When VS Code starts, the extension sets up a listener on the workspace. The listener stays on until the session ends. It sees changes made to any regular file open in the editor. It labels each change as typing, deletion or copy/paste.
A paste of more than roughly 50 characters counts as a COPY_PASTE event. The extension packs the pasted code together with the file name, workspace name and timestamp. It adds a user identifier and the local project path. Then it uploads the bundle to its back end for similarity analysis.
The developer does not have to ask for an AI review. Akamai says this code path skips the consent check that the extension's interactive AI commands use.
Why the consent gap is the real finding
Most security reviews ask what a tool can do. This case shows a better question: which paths does the permission check cover? A consent prompt on the AI button means little if a background task can send the same data without it.
The extension also keeps a local log of typed, pasted and deleted code. Akamai says the log holds real source code, not routine diagnostics. After each update, the extension makes the file read-only. It unlocks the file only to add entries. Akamai says this makes the log harder for users to notice.
The extension also sends project metadata without any user action. This covers workspace details, repository details and project structure. The triggers are start-up, workspace setup, Git branch changes and scheduled background tasks.
Plain HTTP and the vibe-coding angle
All back-end traffic goes to one hard-coded address over plain HTTP, not HTTPS. So TLS does not protect source code, project metadata or authentication tokens. Akamai says an attacker with network access could intercept or change them.
Akamai links the risk to how developers now work. Many generate code with AI and paste large blocks fast. They do not read every line. A paste can carry API keys, secrets or proprietary algorithms they never spotted. Developers may assume it all stays local.
What the report does not say
Akamai does not say how many developers installed the extension. It does not say who runs the back end. It does not say what happens to uploaded code. It also does not claim bad intent. Some capabilities, such as similarity analysis or project indexing, may support legitimate features.
Akamai names two gaps in transparency. The GitHub repository the extension pointed to was unavailable at the time of analysis. The extension also had no published documentation of its design, telemetry or data collection.
What leaders should ask this week
This is one extension, so it does not prove a wider pattern. It is still a useful test for any company whose developers install AI tools freely. Put these questions to your engineering and security leads.
First, do we know which AI extensions run on developer machines, and who approved them? Second, do we watch what those extensions send out, even when nobody asked them to do anything? Akamai advises flagging any transfer of source code or project metadata outside explicit user actions.
Third, does consent apply on every path, including background tasks? Fourth, do we flag any tool that sends code over plain HTTP? Akamai's guidance is that anything carrying source code or tokens should use HTTPS.
The lesson is simple. An AI tool's permission screen shows only what its makers chose to show. Traffic data and runtime behaviour show the rest.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Akamai.
