Malicious AI extensions for Visual Studio Code are harvesting code from approximately 1.5 million developers. Many of these extensions, despite being in official marketplaces and having positive reviews, exploit granted access to workspaces and files for unauthorized data collection.