Compromised AI Coding Agent Extensions/Marketplaces Run Malicious Code on Developer Machines With No Transparency or Approval Gate

Summary

Developers using AI coding agents (Cursor, Claude Code, Codex) install extensions and MCP tools from opaque, unaudited marketplaces they cannot inspect: Cursor ships its own non-public marketplace (neither the Microsoft VS Code gallery nor Open-VSX) that apparently proxies Open-VSX, and nobody — including experienced users — knows what actually ships through it. When the Claude extension in that marketplace was compromised, malicious code executed on developers' machines with no checkpoint, no visibility, and no explanation from the vendor. The pain is intense and public: users are asking 'WTF just happened' because there is no way to verify what an extension will do before it runs, no local policy that pauses installs or tool calls for approval, and no accountability or post-incident transparency from the platform. This is fundamentally unsolved — existing package/extension ecosystems offer at best reputation badges and post-hoc malware takedowns, not a runtime checkpoint that intercepts the agent's shell commands, package installs, secret reads, and MCP tool use before damage is done. Without it, every agent install is an act of blind trust with supply-chain-level blast radius on the developer's own laptop.