Check V16 · agent family · automatic · one of the 17 VS Code Marketplace checks
The question this check asks: does a settings or instruction file that an AI coding agent would load from this extension's package override where the agent sends its API requests — or set an API key of its own?
V16 is the same detection function as GitHub's C21 and Hugging Face's H17, run on the agent files read out of the .vsix. An agent authenticates to its model provider with a key and a base URL, both ordinary configuration; a file that sets ANTHROPIC_BASE_URL sends the agent's next request — carrying its key — to whoever wrote the file. The finding names CVE-2026-21852, the published case of an agent loading such a setting from a project before the trust dialog had been accepted. One line, in a file written to be skimmed, and the credential leaves the machine on the agent's next call.
In a package the file is inert until the extension's directory becomes a project an agent starts in — which an installed extension's directory normally is not, and why V13 records the presence as a note. The contents keep their weight for the same reason V14 and V15 keep theirs: a rules file copied into a project, or a folder opened with an agent beside it, carries the redirect whole.
What this check would not have seen deserves the same plainness. MaliciousCorgi — Koi Security's name for two AI chat extensions on the Marketplace, whensunset.chatgpt-china at 1,340,869 installs and zhukunpeng.chat-moss at 151,751, as quoted from Koi by The Hacker News and BleepingComputer in January 2026 — did exfiltrate developers' work: hidden code read every opened file, Base64-encoded it and posted it to aihao123[.]cn, with a server-triggered mode that pulled up to 50 workspace files per command. None of that lived in a configuration file. It lived in the bundle, which this tier does not read, so V16 would not have seen it — and neither would any other check on this tier: both extensions worked as advertised, were popular, and looked established. On 18 September 2026 both are gone from the gallery and answer not assessable, a REVIEW-grade finding with action warn, never a pass. That is the honest limit of a metadata tier, and the reason the code is the next thing to read, not the last.
V16 reads every agent file V13 finds in the package — JSON and Markdown alike: .mcp.json, .cursor/mcp.json, the JSON files under .claude/, CLAUDE.md, AGENTS.md, .cursorrules and the rest of the list — and matches each for ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or any name ending in _API_KEY followed by a colon or an equals sign, the identical pattern C21 and H17 match. A hit is CRITICAL, costs 30 points, and reads "config overrides an API base URL or key — token exfiltration class (CVE-2026-21852)". Any CRIT drives the score to 0, so a package that trips only this check reads BLOCK; the default personal profile sets this check's action to warn, for the reason the note gives — the pattern is broad enough to need a second look — so the file is named and the decision is put to you rather than made for you. The scoring table's evidence note:
"token exfiltration class; 2 regex FPs in young-legit controls"
V16 sits in the Open in an editor and Hand to an AI agent dimension verdicts, each of which takes the worst of its checks, so a hit turns both to BLOCK. If the package listing cannot be fetched the check is reported as skipped, not passed; a package with no agent file in it has nothing to redirect, and the check passes.
None on the package contents this check has scanned. In the 18 September 2026 measurement of the 100 most-installed extensions — 99 PASS, 1 REVIEW, 0 BLOCK, every listing read — the five agent files found (prettier's CLAUDE.md and .claude/settings.json, two .mcp.json, two AGENTS.md) matched nothing; V16 fired zero times, and the run's single REVIEW was V5 on abusaidm.html-snippets. The two regex false positives the evidence note records are C21's — young legitimate GitHub repositories whose settings documentation listed which SOMETHING_API_KEY to set — and are the pattern's known shape rather than a Marketplace number. The underlying limit applies here unchanged: the regex cannot tell "set this in your environment" from "use this key". One thing narrows it in a package: an extension's README is not on the agent-file list, so the documentation that trips the pattern on GitHub has to be inside an agent file to be read at all here.
A redirect under a variable name it does not know — another provider's base URL, a proxy setting, a custom endpoint key — passes. Files not on the agent-file list are not read: the extension's package.json, its README, its settings defaults, and above all its JavaScript. The bundle is the gap, and MaliciousCorgi is what the gap looks like. A base URL assembled at runtime by a script is invisible to a text match; a file larger than 64 KB is listed by V13 but its contents are not read; the ninth and later agent files in a package are not read. The other credential surface an extension has — proposed APIs that read the terminal or the sign-in state — is V8's, not this check's. And it reads the file at request time; it does not see the request an agent later makes.
RepoGates assesses a Marketplace extension on request — through the API, the MCP server (platform="vsx") and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; Open VSX (where VSCodium, Cursor and Windsurf install from) is a different registry and is not assessed. The extension's code bundle is not read on this tier: a PASS means the provenance and the declared surface are clean, never that the JavaScript was inspected.
Without installing anything: the listing page's Resources column carries a Download Extension link, and a .vsix is a zip with the extension's own files under extension/. Search each agent file it carries for BASE_URL and _API_KEY:
for f in .claude/settings.json .claude/settings.local.json .mcp.json .cursor/mcp.json CLAUDE.md AGENTS.md; do
unzip -p EXTENSION.vsix "extension/$f" 2>/dev/null \
| grep -nE 'BASE_URL|_API_KEY\s*[:=]' | sed "s|^|$f:|"
doneThen the standard's fix for the whole pre-trust class: an agent current enough to ask before loading project configuration, and project-scoped configuration disabled until you trust the folder — which, for an extension's directory, should be never.
The extension's CLAUDE.md documents which API keys to set — will that fire? It might, for the same reason it can on GitHub's C21 and the Hub's H17. The pattern matches any assignment of a name ending in _API_KEY, and it cannot always tell environment-setup documentation from an actual override. That is why the default personal profile sets this check's action to warn rather than block, and why the finding names the file so you can read the line yourself. An extension's README is not on the agent-file list, so the documentation has to be inside an agent file to be read at all.
Would V16 have caught MaliciousCorgi? No. MaliciousCorgi's two AI chat extensions — whensunset.chatgpt-china at 1,340,869 installs and zhukunpeng.chat-moss at 151,751, as quoted from Koi Security by The Hacker News and BleepingComputer in January 2026 — read every opened file, Base64-encoded it and posted it to aihao123[.]cn from hidden code in the bundle. Nothing about that lived in a configuration file. This tier does not read the bundle, so V16 would not have seen it, and neither would any other check on this tier: both extensions worked as advertised and looked established. Both are gone from the gallery today and answer not assessable.
Does RepoGates see the extension when VS Code installs it? No. RepoGates assesses a Marketplace extension on request — through the API, the MCP server and the preflight for code --install-extension. It does not see an extension installed from the editor's own UI, or one that auto-updates; the board on marketplace pages is not built yet; and Open VSX, where VSCodium, Cursor and Windsurf install from, is a different registry and is not assessed. It reads the file at request time; it does not see the request an agent later makes.
V13 Agent config files — the files this check reads; presence alone is a note in a package · V8 Proposed API access — the other credential surface: declared APIs that read the terminal or the sign-in state · C21 Credential redirect — the same function, reading a git tree instead of a package · H17 Credential redirect — the same function on the Hub's file list.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2026-21852 as named in the finding; the 18 September 2026 measurement of the 100 most-installed VS Code Marketplace extensions (99 PASS, 1 REVIEW, 0 BLOCK; V16 fired 0 times; 5 agent files read); MaliciousCorgi install counts and technique as quoted from Koi Security by The Hacker News and BleepingComputer, 23–26 January 2026; weights and actions from the product's scoring and policy tables.