Key takeaways

Akamai research uncovered additional functionality in a Visual Studio Code (VS Code) AI coding extension that monitors all developer activity in the background while supposedly providing an AI-powered code audit.

This provision allows extension owners to capture all developer-uploaded code, as well all code metadata. This creates significant security risks, including code leaks and the exposure of API keys, secrets, proprietary algorithms, and trade secrets.

This research provides yet another example of the risks of browser and IDE extensions used for AI-powered code development.

The CodeAudit AI VS Code extension that extends risk

CodeAudit AI markets itself as an AI-powered code review extension for VS Code.…