VS Code extensions run unsandboxed; the few security tools one expert tested missed them

Code editor extensions run with the full power of the developer who installs them, and the endpoint security tools one researcher tested ignored them. Raphael Silva made this case in a talk on the OWASP Foundation channel, recorded at OWASP AppSec Days Portugal in September 2026.

What was said

Silva said developer machines are among the highest-access systems in a company. In his words, "They pretty much have all of the keys to the kingdom." They hold credentials and source code, and one leaked API key can do serious harm. He then described the gap. Browser extensions run in a sandbox, a walled area that limits what they can touch. Editor extensions do not. "An extension that you install has complete access to your systems and it can execute whatever you can execute as your user." That reaches project files, terminals, environment variables and private keys, he said. Silva added that an extension is mostly a JavaScript project in a zip-like package, and it can pull in its own dependencies. If a firm counts npm packages as supply chain risk, he argued, it should count extensions too. Two or three endpoint security tools he tested paid no attention to editor extensions. He called it a blind spot last year and again this year. He focused on forks of VS Code, such as Cursor, Windsurf and Antigravity. From the best figures he could find, he put them at 18 to 22 percent of market share.

Why it matters

Our reading: the exposure grows with every new coding tool a team adopts. Silva said the AI-focused editors he named are forks of VS Code, so they inherit the same unsandboxed model. He did not claim AI makes the problem worse. That link is ours. For managers, three questions follow. Does your software inventory list editor extensions, or only packages? Who approves which extensions developers may install? Can your security vendor see extensions at all? Silva also noted that extensions auto-update. He thought Microsoft had added a default delay of about two hours, which he said is close to nothing.

The other side

The evidence has limits. Silva said he did not test many security products, so his finding covers a small sample. He also said reliable statistics on who uses which editor are scarce. The picture is not static either. He said OpenVSX, the extension registry most of these forks use, began adding controls after a July spike in malware. Attacks became a little harder, but "It's not like 100% fixed after that." Malware is still published there every day, he said. Most of the time, it is not in popular extensions. The talk leaves open how much a company can do while the editors themselves offer no sandbox.