{
  "entry": {
    "kind": "vuln",
    "slug": "malicious-ai-assistant-extensions-harvest-llm-chat-histories-from-vs",
    "name": "malicious-ai-assistant-extensions-harvest-llm-chat-histories-from-vs",
    "vendor": "Multiple malicious VS Code extensions",
    "description": "Microsoft Security researchers identified malicious VS Code extensions masquerading as AI coding assistants that silently harvest LLM conversation histories, including code snippets, API keys, and proprietary logic discussed in chat. The extensions use obfuscated telemetry endpoints to exfiltrate data. The campaign builds on earlier MaliciousCorgi findings where extensions with 1.5M+ installs were found siphoning developer source code to external servers.",
    "website": "https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ide-extension",
    "updatedAt": "2026-04-03",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "malicious-ai-assistant-extensions-harvest-llm-chat-histories-from-vs",
      "aliases": [
        "ti-017"
      ],
      "title": "Malicious AI Assistant Extensions Harvest LLM Chat Histories from VS Code",
      "summary": "Microsoft Security researchers identified malicious VS Code extensions masquerading as AI coding assistants that silently harvest LLM conversation histories, including code snippets, API keys, and proprietary logic discussed in chat. The extensions use obfuscated telemetry endpoints to exfiltrate data. The campaign builds on earlier MaliciousCorgi findings where extensions with 1.5M+ installs were found siphoning developer source code to external servers.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Data exfiltration"
      ],
      "componentType": "ide-extension",
      "component": {
        "name": "Multiple malicious VS Code extensions",
        "vendor": null,
        "package": null,
        "ecosystem": "vscode",
        "catalogSlug": "agent/vscode"
      },
      "affected": [
        {
          "range": "Multiple malicious VS Code extensions (various publishers)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-03",
      "modifiedAt": "2026-04-03",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/"
        }
      ],
      "mitigation": "Audit installed VS Code extensions against known-good publisher lists. Remove extensions from unknown publishers. Enable extension publisher allowlists via Anomity policy. Monitor for unexpected outbound network requests from IDE processes.",
      "detectedByAnomity": true
    }
  }
}