One Click in Untrusted VS Code Installs Persistent Spyware Microsoft Still Will Not Patch

Remedio (Omri Dar, 17 September 2026) disclosed a Workspace Trust bypass in Visual Studio Code. A single click on a command: link in the plain source editor can silently install a local malicious VSIX and keep that code running on every later launch.

This is a research disclosure. It is not a CVE, not a Microsoft security bulletin, and not confirmed exploitation in the wild. Cyber Security News (Abinaya, 18 September 2026) carried the same finding.

VS Code DocumentLink URLs in the source editor fire with allowCommands set to true and no Workspace Trust check. After CVE-2022-41034, Microsoft hardened Markdown preview so command: links are stripped there. The source editor path was left open.

The install command workbench.extensions.installExtension then accepts a local VSIX. If the package declares untrustedWorkspaces.supported as true, the soft trust prompt never appears.

The trap can present itself. A .vscode/settings.json with workbench.startupEditor set to readme opens the project README on folder open, and naming the file README.markdown (not README.md) routes it to the source editor instead of the hardened preview.

Remedio reported the chain to the Microsoft Security Response Center. Microsoft classified it as a Moderate Security Feature Bypass, declined a CVE, and said it duplicates an earlier submission.

Remedio says it still works on the latest stable release. The fully automatic version needs the attacker to know the victim's absolute folder path, and UNC network shares are blocked.

Related workstation and agent tape includes the Plugin4Shell zero-click AI agent flaw, the BragJack browser AI extension hijack, and OpenAI rogue agents on Hugging Face.

If you open unfamiliar folders in VS Code, set editor.links to false in User settings today so source-editor links stop being clickable, then audit Extensions and remove any VSIX you did not install on purpose.