--- url: "https://www.xcademia.com/news/akamai-finds-codeaudit-ai-vs-code-extension-monitoring-developer-activity" title: Akamai Finds CodeAudit AI VS Code Extension Monitoring Developer Activity description: "Akamai reports that CodeAudit AI monitors VS Code activity, uploads pasted code and exposes developer data through unencrypted HTTP communications." publishedAt: "2026-10-14T10:49:26.784+00:00" updatedAt: "2026-10-14T12:30:52.118771+00:00" type: news category: cybersecurity source_name: Akamai source_url: "https://www.akamai.com/blog/ai/vibe-coding-vs-code-extension-monitors-developer-activity" tags: - "#Cybersecurity" - "#AICoding" - "#VSCode" - "#CodeAuditAI" - "#SourceCodeSecurity" - "#DeveloperSecurity" - "#DataExfiltration" - "#SoftwareSupplyChain" --- # Akamai Finds CodeAudit AI VS Code Extension Monitoring Developer Activity > Akamai researchers report that the CodeAudit AI VS Code extension monitors developer edits, uploads pasted code and collects project metadata in the background. The findings highlight security risks associated with unverified AI coding extensions. Source: **Akamai** · 14 October 2026 AI-powered coding tools are changing how developers write, review and maintain software. However, extensions that operate inside development environments can also create security risks when their data collection practices exceed what users expect. Akamai also reported that the extension communicates with its backend over unencrypted HTTP, potentially exposing transmitted information to interception or modification. The findings highlight an important security consideration for developers adopting AI-assisted programming: reviewing an extension's advertised functionality is not enough. Its actual behaviour, network communications and data handling practices also matter. ## What is CodeAudit AI? CodeAudit AI is a VS Code extension presented as an AI-powered code review tool. Akamai's investigation identified additional functionality that operates independently of the extension's interactive AI review commands. The researchers reported two transparency concerns. At the time of their analysis, the GitHub repository referenced by the extension was unavailable, and the extension did not provide published documentation explaining its architecture, telemetry or data collection practices. These limitations made it harder for users to assess how the extension handled source code and project information before installing it. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971808433-info1--122-.webp) ### 1. Continuous monitoring of editor activity Akamai reported that CodeAudit AI registers a global workspace listener when the extension starts. According to the analysis, the listener remains active throughout the VS Code session and observes edits to ordinary files within the workspace, regardless of whether the developer is actively using an AI review feature. The reported information collected during editing includes: - Inserted and deleted text - File names and workspace names - Absolute project paths - Edit locations and timestamps - User identifiers The extension reportedly classifies activity as typing, deletion or copy-and-paste operations. This gives it visibility into source-code changes beyond the specific code snippets a developer might intentionally submit for review. For developers working on proprietary software, this distinction is significant. Source code may contain internal business logic, unpublished functionality, implementation details and sensitive configuration values. Unintended collection can therefore create risks even when the developer is not deliberately sharing code with an AI service. ### 2. Pasted source code can be uploaded automatically One of the most concerning findings concerns the handling of pasted text. According to Akamai, when a developer pastes more than approximately 50 characters, the extension classifies the event as a copy-and-paste operation and creates a payload containing the pasted code and associated metadata. The researchers reported that this information is automatically sent to a remote backend without requiring the developer to initiate an AI review. The payload can include the file name, workspace name, timestamp, user identifier and local project path. Akamai also reported that this upload pathway did not apply the same consent validation used by the extension's interactive AI commands. As a result, the reported collection could occur independently of the usual review workflow. This behaviour creates a potential exposure risk for API keys, authentication tokens, database credentials and other secrets if developers paste them into monitored files. Proprietary algorithms and unreleased product code could also be exposed. The report identifies the collection and transmission behaviour. It does not, by itself, establish that every type of sensitive information was successfully captured or that a particular organisation suffered a confirmed breach. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971826883-info2--123-.webp) ### 3. Persistent local logs record developer activity The investigation also identified a local logging mechanism. Akamai reported that the extension writes activity records to the following path: `~/.ai_extension_logs/activity_tracker.txt` According to the research, the file can contain typed, pasted and deleted code, alongside file names, project identifiers and timestamps. The researchers also observed that the extension changes the log file's permissions to read-only after updates, temporarily restoring write permissions when adding further entries. Although a local file is not the same as a remote upload, persistent records of developer activity introduce another potential exposure point. Anyone or any process that gains sufficient access to the machine or the log file could potentially access information recorded there, depending on the applicable permissions and system configuration. For organisations, the finding reinforces the importance of understanding what developer tools store locally, how long they retain it and which users or processes can access it. ### 4. Background collection extends to project metadata Akamai reported that CodeAudit AI also sends project metadata to its backend during events such as extension start-up, workspace initialisation, Git branch changes and scheduled background tasks. The information described in the report includes: - Workspace names and absolute paths - Git branch names and remote repository URLs - Project directory structures - Dependency information - Project statistics Such information can reveal details about a development environment even when it does not contain the complete source code. Repository addresses, directory structures and dependency lists may help someone understand a project's organisation, technology choices or internal development setup. The central issue is not that all metadata collection is inherently malicious. Some extensions legitimately require project context to deliver their functionality. The security concern is whether the collection is necessary, clearly disclosed, appropriately protected and consistent with the user's expectations. In this case, Akamai reported that the metadata transmissions occurred in the background rather than solely in response to an explicit AI analysis request. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791971848495-info3--122-.webp) ### 5. Unencrypted HTTP communication creates additional risk Akamai identified the following hard-coded backend endpoint in its analysis: `http://65.1.14.40:8000/api/v1` The researchers reported that the extension used plain HTTP rather than HTTPS for backend communication. This matters because HTTP does not provide TLS encryption or TLS-based server authentication. Depending on the network environment, an attacker with an appropriate position on the communication path may be able to observe or modify transmitted information. If source code, project metadata or authentication tokens are sent over such a connection, the lack of transport encryption increases the risk of interception or tampering. Using HTTPS is a fundamental safeguard for protecting data in transit. However, encryption alone cannot establish that a service is trustworthy or that its data collection practices are appropriate. Developers and security teams must assess both the security of the connection and the legitimacy of the destination. ## Indicators of compromise Akamai published the following indicators associated with its analysis of CodeAudit AI. Indicator Reported value VS Code extension identifier `TejasKulkarni.codeaudit-ai` Backend IP address `65.1.14.40` Backend endpoint `http://65.1.14.40:8000/api/v1` Local activity log `~/.ai_extension_logs/activity_tracker.txt` Security teams can use these indicators as starting points for investigation. They should validate the findings against their own telemetry and current threat intelligence before taking action. An indicator alone does not prove that a particular machine has been compromised. ## What developers and security teams should do Akamai recommends examining IDE extensions beyond their advertised features, monitoring their network activity, applying consent controls consistently, limiting unnecessary background telemetry and requiring secure communication channels. Developers and organisations can translate those recommendations into practical steps. **For individual developers** 1. Review installed VS Code extensions and remove tools that are unnecessary or cannot be adequately verified. 2. Check the publisher, extension identifier, available source code, documentation and permissions before installing an AI coding extension. 3. Inspect unexpected outbound connections from development environments, especially connections that transmit code or project information without an explicit user action. 4. Avoid pasting production credentials, API keys or other secrets into development files. Use environment variables and an appropriate secrets-management workflow instead. 5. If an extension is suspected of exposing credentials, investigate the scope of potential exposure and rotate affected secrets when warranted. **For engineering and security teams** 1. Maintain an approved list of IDE extensions and establish a review process for new tools. 2. Test extensions in an isolated environment before permitting their use on systems containing sensitive source code. 3. Monitor outbound traffic for unexpected destinations and unencrypted connections from developer workstations. 4. Review endpoint telemetry and local files for relevant indicators, while validating findings before classifying a system as compromised. 5. Apply data-loss prevention controls and secrets scanning where appropriate, and define clear policies for using AI-assisted development tools. 6. Require extension developers or vendors to explain data collection, retention, transmission and consent practices before approval. Organisations should also distinguish between a tool's legitimate processing requirements and collection that occurs outside the user's intended workflow. Clear documentation and consistent consent enforcement are essential to that assessment. ## What the findings mean for AI-assisted development The CodeAudit AI investigation illustrates a broader security challenge as developers adopt AI tools to accelerate software creation. IDE extensions often operate close to source code, project files and development credentials. This access can make them useful, but it also means their behaviour deserves careful scrutiny. For engineering leaders, the lesson is to treat AI coding extensions as software supply-chain and data-governance considerations rather than simply productivity add-ons. Approval processes should examine what a tool can access, what it transmits, where the data goes and whether those actions match the functionality users have requested. For extension developers, transparent documentation, data minimisation, secure transport and consistent consent checks are important design considerations. For end users, the presence of an AI feature should not be treated as evidence that every background operation is necessary or safe. Akamai's report documents specific behaviours found in its analysis of CodeAudit AI. It should not be interpreted as evidence that every AI coding extension behaves similarly, or that a confirmed breach has occurred at every organisation using the extension. ## Conclusion Akamai's findings show why developers need to examine the actual behaviour of AI-powered IDE extensions, not just their advertised features. In the CodeAudit AI case, the reported combination of continuous edit monitoring, automatic pasted-code uploads, persistent local logging, background metadata collection and unencrypted HTTP communication raises material privacy and security concerns. The practical response is to verify extensions before deployment, monitor their access and network behaviour, protect secrets and enforce clear data-handling requirements. As AI-assisted coding becomes more common, maintaining visibility over the tools inside development environments will remain an important part of protecting source code and the wider software supply chain. ## Original source https://www.akamai.com/blog/ai/vibe-coding-vs-code-extension-monitors-developer-activity ## Tags `#Cybersecurity` · `#AICoding` · `#VSCode` · `#CodeAuditAI` · `#SourceCodeSecurity` · `#DeveloperSecurity` · `#DataExfiltration` · `#SoftwareSupplyChain` --- ## About this content This Markdown news article is the citation-grade twin of [Akamai Finds CodeAudit AI VS Code Extension Monitoring Developer Activity](https://www.xcademia.com/news/akamai-finds-codeaudit-ai-vs-code-extension-monitoring-developer-activity). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/akamai-finds-codeaudit-ai-vs-code-extension-monitoring-developer-activity - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt