Analysis · curated 8 Aug 2026
AI security in VS Code
First reported visualstudio.com
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
VS Code's agent security controls give defenders concrete configuration levers—sandboxing, trust boundaries, and MCP vetting—to reduce the blast radius of prompt-injection and tool-abuse against AI coding agents.
VS Code documentation describes built-in security controls for AI-powered agentic development, including Workspace Trust restricted mode, agent sandboxing to limit file system and network access, mandatory review of file edits, protection of sensitive files, session-scoped auto-approval, and vetting of MCP servers before trusting them. The page frames these as trust boundaries to limit the impact of autonomous agent actions on untrusted projects.