Story
MaliciousCorgi: AI Extensions send your code to China
1 report
1 website
1 discussion
Latest report
Overview
Malicious AI extensions for Visual Studio Code are harvesting code from approximately 1.5 million developers. Many of these extensions, despite being in official marketplaces and having positive reviews, exploit granted access to workspaces and files for unauthorized data collection.
Summary from koi.ai.
Report summaries: 1 not verified.
Community analysis available for 1 of 1 linked discussions.
Additional discussion searches are still incomplete.
Coverage details and dates
Latest available community analysis:
Summaries: 0 current · 0 awaiting update · 1 not verified
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · koi.ai
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-02-02.
- Concern: The concern about AI extensions potentially sending code to external servers raises significant security and privacy issues, highlighting a major risk in using such tools.
- Concern: There is a strong sentiment against using AI plugins in VS Code due to fears of data leakage, which could undermine trust in AI-assisted development.
- Concern: The comparison of VS Code with other editors suggests that many users prefer faster and more secure alternatives, indicating dissatisfaction with the current state of AI integration.
Explore related coverage
Related stories
Separate stories sharing a model or topic, from the last 30 days.
- There isn't an easy exploit for this PHP vulnerability
Shared topics: developer-tools
- Recursive launches Flint, a laptop coding model it says was largely built by AI
Shared topics: developer-tools
- OpenAI's latest AI models are coming to Google Cloud and Antigravity
Shared topics: developer-tools