AI coding tools recommend extensions that can be spoofed

Windsurf, Cursor and Google Antigravity are built on VSCode but use the open OpenVSX registry rather than Microsoft's. They nevertheless inherited VSCode's list of recommended extensions, and some of those do not exist in OpenVSX. Researchers at Koi pointed out that an attacker could register extensions under the same names and have them recommended to developers. Koi registered six such names themselves to prevent abuse. With no real functionality, they were installed by more than 1,000 developers. Cursor and Google have addressed the issue; Windsurf had not responded. There is no indication of exploitation in the wild.

What this means for your organisation

Developer machines hold source code, build pipelines, cloud keys and paths into production. An extension installed on the tool's own recommendation normally passes no review at all. When engineering adopts AI tooling on its own initiative, the attack surface grows without anyone treating it as a supplier decision.

Berigo recommends

• Establish which AI coding tools are actually in use, including those not procured centrally.
• Introduce an approval list for editor extensions, on the same footing as other software.
• Treat extension registries as suppliers and ask who may publish under which names.
• Separate developers' access to production secrets from their day-to-day workstation.

Source

• koi.ai
• bleepingcomputer.com