The trust boundary breaks because the extension can inherit the developer’s delegated access and turn local convenience into persistent cloud reach. Refresh tokens, environment variables, and browser-assisted login flows become credentials the attacker can reuse outside the user session. That is why extension approval must be tied to credential exposure, not just editor functionality.
How the trust boundary fails when an IDE extension can see developer tokens
An IDE extension changes from a productivity tool into a delegated access path the moment it can read the same tokens, environment values, or browser-backed sessions the developer uses. At that point the real boundary is no longer the editor UI, it is the credential exposure surface. A malicious extension can reuse that trust outside the user session, so approval has to be based on what it can reach, not just what it can render.
That is why developer tokens matter more than extension features. Once an extension can observe or copy refresh material, it can persist after the IDE closes, survive sign-out, and act with the developer’s authority from another machine or process.
Which credential paths usually become exposed
The most important paths are the ones that turn local convenience into reusable access. Browser-assisted login flows can hand an extension tokens that were meant to be short-lived in the browser context, while environment variables and cached secrets may expose service access with no visible prompt at all. In practice, this is the difference between a harmless plugin and a control point for cloud, source control, or SaaS access.
When the token can authenticate outside the editor, the attacker no longer needs the IDE session to remain open. That shifts the problem from “extension misuse” to “credential reuse,” which is a much larger blast radius because the token may already be trusted by downstream systems.
Why token access turns a local compromise into broader account abuse
A malicious extension is especially dangerous when it can inherit delegated access and operate as if it were the developer. That creates a path to source repositories, package registries, CI systems, issue trackers, and cloud consoles if those systems trust the same credential chain. Good examples include token theft, token replay, privilege expansion through linked sessions, and lateral movement into adjacent developer tooling.
Secrets in VS Code extensions 2025 shows how extension ecosystems can expose publishing tokens and other credentials at scale, while JetBrains GitHub plugin token exposure demonstrates how an IDE plugin can turn a developer token into account-level reach. For a compromise that spreads through workflows rather than a single app, GlassWorm campaign 2025 is the clearest reminder that extension trust can become supply-chain trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The subject is credential exposure from an IDE extension. |
| NHI-04 — Insecure Authentication | The issue centers on reusable tokens and replayable delegated access. | |
| NHI-05 — Overprivileged NHI | Malicious extensions can inherit more authority than they need. | |
| Recommendation — Limit extension access to secrets and remove any token paths it can read. Require stronger token binding and revoke any reusable authentication material. Reduce the extension's token scope to the minimum required access. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Developer tokens and refresh material need lifecycle control and revocation. |
| AC-6 — Least Privilege | The extension should not inherit broad delegated access by default. | |
| IA-9 — Service Identification and Authentication | The compromise path can involve non-human or service credentials reused by tooling. | |
| Recommendation — Manage token issuance, storage, rotation, and revocation as controlled authenticators. Constrain extension permissions to the minimum functions and resources. Authenticate tool and service access with narrowly scoped, auditable credentials. | ||
Practitioner Guidance
What to prioritize: Treat any extension that can read tokens, env vars, browser session state, or auth callbacks as credential-exposed software, not as an ordinary editor add-on. Approval should depend on the exact data path it can observe, the lifetime of what it can copy, and whether that material can be replayed elsewhere.
What to verify: Confirm whether the extension has access to refresh tokens, cloud CLI profiles, federated browser sessions, or secrets injected into the IDE process. If it does, verify whether those credentials are scoped, sender-constrained, and revocable without breaking unrelated developer work. OWASP Cheat Sheet Series is useful here because the control question is really about session and secret handling, not editor features.
Decision rule: If the extension can reach a credential that would still work after it leaves the user session, require stronger review, tighter scope, or outright denial. If the token is bearer-only and broadly reusable, assume compromise of the extension equals compromise of the delegated access path.
Practitioner takeaway: The safe question is not “Can the extension edit code?” It is “Can it observe or reuse any credential whose authority outlives the IDE session?”
Related resources from NHI Mgmt Group
- What breaks when a malicious developer extension reaches repository access on a managed workstation?
- What breaks when malicious code can run inside a developer IDE or package install?
- What breaks when a malicious IDE extension can read cloud credentials and environment variables?
- What breaks when a malicious dependency can read developer credentials and cloud tokens?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org