Visual Studio Code

GitHub Copilot Traffic Analysis via MITM Proxy Exposes Prompt Context Handling and Local SQLite Session Storage

A detailed reverse-engineering study placed GitHub Copilot behind an mitmproxy instance to inspect all network requests made by Visual Studio Code. The analysis revealed that Copilot performs OAuth token exchange, model availability checks, and intent classification before any user input occurs. Prompts sent to the model include context from recently edited files, even when inline suggestions are disabled for sensitive extensions such as .env. Copilot maintains a local SQLite database named session-store.db that records every user prompt, LLM response, repository, and branch worked on. The extension also exposes a session_store_sql tool allowing the model to run read-only SQL queries against this history using the Copilot Chronicle skill. These findings highlight how AI coding assistants manage context, authentication, and persistent local state.

Malicious VS Code Extensions Masquerading as Solidity Tools Steal Crypto Wallets, API Keys and Credentials

Two malicious Visual Studio Code extensions promoted as Solidity development utilities have been used to steal cryptocurrency wallet data from browsers along with API keys and stored credentials. The extensions, identified as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, target developers working with smart contracts and Web3 environments where sensitive tokens and sessions are commonly present. Attackers rely on the trusted VS Code marketplace to deliver the payload through a simple installation rather than any complex exploit. Once active, the extensions harvest browser-based crypto wallet information, saved credentials, environment files, SSH keys and API tokens. A single compromised workstation can therefore expose repositories, cloud services and directly drain cryptocurrency funds. Security researchers recommend immediate removal of both extensions, rotation of all accessible secrets and adoption of stricter extension allow-list policies. The incident highlights ongoing supply-chain risks in developer tooling ecosystems.

RCE Vulnerability in AI Code Editors Cursor, VS Code and Google Antigravity Threatens 50 Million Developers

Researchers at AISLE discovered a critical remote code execution vulnerability affecting the AI-powered code editors Cursor, Microsoft Visual Studio Code and Google Antigravity. The flaw allowed attackers to achieve RCE simply by tricking a developer into opening a specially crafted link embedded in a Git commit message. Successful exploitation granted full access to API keys, local files, and the ability to install persistent malware without any visible indicators. The issue stemmed from shared architectural components inherited from the Visual Studio Code codebase, which Cursor and Google Antigravity both adopted. All three vendors have released patches, yet the incident highlights systemic supply-chain risks in the rapidly growing AI-IDE ecosystem. Approximately 50 million developers were potentially exposed before fixes were deployed.