Upcoming Webinar

Your Agent’s Allowlist Is Now Part of the Supply Chain

Thursday, December 3rd at 11:00AM EST | 2:00PM PST 

Legit Security researcher Kirill Efimov scanned all 154,420 extensions in the VS Code Marketplace. The findings were startling and should be a wake up call to anyone focused on AppSec and software supply chain security.

Almost 1 in 100 ships Claude Code’s local settings file, the file that records every command a developer approved with “allow always.” About 4,500 extensions carry files from roughly 30 AI coding tools, and some of them have millions of installs.

Several still contain live API keys. In 17% of the shipped allowlists, the agent can publish a new version of the extension to every user with no one approving it.

Extensions run on developer machines full of cloud logins, SSH keys and tokens. That makes these files a supply chain problem, and the default publishing tools don’t check for them.

In this session, Kirill walks through how the scan worked, what turned up and why the numbers dropped after Claude Code’s auto mode launched. You’ll also learn what security teams and extension publishers should change before their next release.

You'll learn:

  • Which agent files end up in published packages, and how credentials get into them
  • How a shipped allowlist can let an agent push an update without review
  • The publishing checks and ignore rules that keep agent files out of your releases


Submit the form to register for the webinar.

 

Next Stop

Book a free consultation today. You'll see how Legit can:

  • Find everything impacting your AppSec posture through a unified view of all application risk – from code to cloud.
  • Fix the issues that create the most business risk with deep context to prioritize and action remediation.
  • Prevent future risk by automating the time-intensive, manual processes associated with triage and remediation.

In addition, as you build your AppSec program, we can help you:

  • Map and visualize your entire software supply chain.
  • Optimize your vulnerability management processes.
  • Align your program with key compliance standards and frameworks.
  • Implement advanced secrets detection and prevention.
  • Identify use of GenAI in your development.