AgentGuards for VS Code: a scanner for the extensions you install

In August, Manifold Security found 77 Open VSX extensions that copied the name, namespace and description of real VS Code Marketplace extensions. Most were published as version 0.0.1. Nineteen of them collected workspace paths, git remotes, branch names and CI environment values, and sent them to a domain registered on July 15. Open VSX had removed them by August 3. As Manifold points out, that doesn't undo an install that already happened.

That's the problem our new VS Code extension is for. AgentGuards — Extension Scanner 0.1.0 shipped on 2026-11-05.

Why extensions are worth checking

VS Code's own documentation says it plainly: "The extension host has the same permissions as VS Code itself." An extension can read and write your files, make network requests and run external processes. On a developer machine, that puts SSH keys, cloud credentials and tokens in your shell profile within reach.

The evil-twin batch wasn't the first case. In late 2025 the GlassWorm campaign used "invisible Unicode malware that runs as JavaScript while appearing blank in editors" and went after NPM, GitHub and Git credentials. Reading an extension's store page won't catch either of those.

What it checks

The extension checks every extension you already have, and each one you install or update afterwards, for:

• Malware behaviour in the code. This means reading credential files (~/.ssh, ~/.aws, browser profiles, crypto wallets), sending data to exfiltration endpoints, downloading and running code, obfuscated code, and bundled programs. These signals are judged together, so a language server that legitimately runs programs isn't flagged for that alone.
• Known-malware packages bundled inside the extension.
• Known vulnerabilities (CVEs) in bundled dependencies. On their own, these are at most medium risk.
• Publisher reputation: unverified publishers, very new extensions, and names that imitate a popular extension.

If an extension comes back malicious or high risk, you get a warning with Uninstall, Show Details and Ignore. A medium-risk result shows up as a notification. Turn the setting agentguards.notifyMedium off if you'd rather not see those.

One limit: extensions installed from a .vsix file or from a private gallery aren't checked, because they aren't in a public store.

What leaves your machine

The extension sends only each extension's ID, version and platform, plus your editor's name. It never sends code, files or workspace content. AgentGuards downloads the extension from the public store and analyses it on our own servers.

Connect Claude Code and Codex

A Coding Agents list shows whether the Claude Code and Codex CLIs on your machine are protected. Connect Coding Agents runs the official AgentGuards installer in a visible terminal. Before it runs, the extension checks the installer's SHA-256 checksum against the GitHub release.

Install

The extension is free to install and needs an AgentGuards account. You can sign in from inside the extension in three ways: reuse the key the AgentGuards installer already set up, sign in through the browser, or paste an API key.

• VS Code Marketplace
• Open VSX, for editors like Cursor, Windsurf and VSCodium. We haven't tested it in those editors yet.

After installing, look for the AgentGuards shield in the activity bar on the left. If it isn't there, reload the window (Command Palette → Developer: Reload Window). You can also click AgentGuards: Sign in in the status bar at the bottom.

Each extension version checked uses one request from your plan. Re-checking the same version within 30 days is free. If your plan runs out, extensions already known to be malicious or high risk are still flagged. Checking agent status uses no requests.

What we've tested so far

• VS Code on Linux, against production. Prettier came back clean. Live Server was flagged medium because of a bundled dependency with a known vulnerability, and we uninstalled it from the warning. Claude Code and Codex showed as protected, and Connect installed into both on a fresh setup.
• VS Code on macOS (Apple silicon). The extension starts, downloads and verifies the installer, and the agent status check runs. We haven't run sign-in, scanning or Connect on a Mac yet.
• Not tested yet: Windows, Cursor, Windsurf, VSCodium, and remote SSH/WSL windows.

The compatibility page shows the current status.

Setup steps are in the docs. Once you're signed in, the VS Code guide walks you through setup in the dashboard. New to AgentGuards? Start here.