IDE extensions are a lucrative slice of the modern bug bounty scope. They run with privileged capabilities, parse arbitrary workspace files, and increasingly ship LLM backed agentic features that execute commands, edit files, and follow instructions found in the project under review. AI assistants have become an exploit chain accelerator: agents touch every stage from file ingestion to primitive acquisition to escalation, often with minimal sandboxing. This workshop turns those ideas into hands on practice. Attendees install Nopilot, a deliberately vulnerable mock AI assistant VS Code extension, learn how to debug it, review code for bugs, and chain primitives from "user opened a folder" to code execution that requires no further interaction and bypasses workspace trust entirely. Built around a generalized IDE exploitation killchain and drawn from a multi-six-figure IDE bug bounty practice. Bring a laptop and curiosity.
IDEs are complex. They tend to marry a lot of systems and access in one place. They can quite often be tested white/gray box with a local debugger attached. This allows for deep and thorough research to be performed that leads to high impact vulnerabilties due to the nature of an IDE as a junction point of systems. This complexity, different threat model, and benefit to chaining gadgets into a full chain bugs makes this an interesting space for bug bounty hunters.
Code editors are high trust targets in practice. They have full filesystem access. They run shell commands. They hold cloud credentials and SSH keys. They take a lot of nonstandard sinks and have a lot of codepaths that can lead to both traditional and nonstandard sources. A pretrust bug in any installed extension is roughly equivalent to "open a folder, lose the box."
The workshop is structured around a generalized killchain that holds across IDE distributions:
- Untrusted file infiltration. Workspace dotfiles, agent config, custom file formats, notebook metadata, symlinks, branch names, project files. Anything the attacker can put in the workspace.
- Parsing or rendering trigger. Activation events, custom editors, markdown preview, hook firing, context loaders, file watchers. Whatever causes the extension to read attacker content pretrust.
- Primitive acquisition. Tool dispatch, shell exec, file write, openExternal, postMessage, innerHTML. The thing that turns "extension parsed my file" into "extension did the thing I wanted."
- Escalation. XSS to IPC to host. File write to shell rc to next-shell RCE. Symlink follow to credential exfil. Configuration change to widen sandbox.
- Trust boundary bypass at every stage. Pretrust activation. Untrusted-mode implicit operations. Settings that override gates without prompts. Agentic modes that skip trust entirely.
Every step has a literature, a fix story, and a recurring shape. The workshop runs that framework into the ground until it sticks.
AI features change the math. Agents are confused deputies that read attacker-controlled files and act on instructions found inside them. The classic boundaries (the user is in the loop, the user clicked something, the workspace is trusted) erode, because the AI is the one taking the actions and the AI is the one being prompted.
Specifically, AI integrations:
- Read workspace content as context, including untrusted dotfiles, READMEs, comments, and branch names
- Emit tool calls that bridge that read directly into shell exec, file writes, and HTTP requests
- Get gated by toggles and whitelists that are themselves controlled by attacker-shipped config
- Auto-fire on file events (onSave, onOpen, hook definitions) before the user has clicked anything
- Render their own output as markdown, HTML, or webview content with privileged IPC underneath
The trust inversion is the punchline: an AI assistant designed to take actions on behalf of the user instead takes actions on behalf of an attacker who controls a single file in the workspace.
A surprising number of extension bugs sit unnoticed because the tooling is not obvious. Reading the manifest is the easy part. Inspecting a running webview, attaching a debugger to the extension host, replaying postMessage traffic, and auditing the extension source are skills the workshop covers explicitly because they unlock the rest of the killchain. We use Nopilot as the lab, but the same techniques work across any VSCode fork and any installed extension.
The workshop walks through:
- Inspecting webviews at runtime to probe the DOM, observe
postMessagetraffic, and run payloads in the live webview console - Attaching a debugger to the extension host process and setting breakpoints in extension code
- Understanding how custom extension settings are ingested and how they can be overwritten pretrust
- Surfacing extension log output and runtime errors in real time
- Explore common footguns in implementing VSCode Extensions that are configured to be enabled in untrusted workspaces
Attendees leave able to repeat this workflow on real targets, not just the lab. This is the load bearing piece of the workshop.
Nopilot is a mock AI assistant extension built to embody the patterns above. It looks plausible at a glance: a sidebar chat with markdown rendering, a custom .nopilot file format for named action recipes ("skills") with steps and triggers, slash commands, file save and open triggers, configurable system prompts, a workspace aware context loader, and a user-facing autorun toggle that workspace settings can override. The "AI" is a regex driven echo bot, not a real model. The tool calls (shell exec, file read, file write) are real. The extension intentionally runs pretrust and reads its own gating from workspace settings. Each surface is a vulnerable design choice taken from real shipping AI assistant extensions, with the variable names changed.
Distributed as a single click .vsix. Full TypeScript source available for attendees who want to read it before installing. The repo includes challenge workspaces ranging from "find one primitive" to "build the full pretrust 0 click kill chain."
- 10 min. Threat model crash course. The IDE exploitation killchain, with a live walk through Nopilot's manifest pointing out each stage of the chain in the source.
- 15 min. Tooling primer plus live demo, interleaved. Running the IDE with debug flags, inspecting webviews at runtime, attaching a debugger to the extension host, reading the on disk source of an installed extension. The demo of the debug setup so attendees see the workflow in action, not just slides about it.
- 25 min. Hands on. Attendees pick a primitive (markdown XSS, indirect prompt injection via context files, autorun gating bypass via settings, onOpen trigger via
.nopilotfile, path traversal, custom editor surface) and build their own chain. Sample workspaces may be provided as scaffolds. - 10 min. A review and hands on walk through of some of the more interesting challenge pieces and a full pretrust code execution exploit chain.
By the end of the hour an attendee should be able to:
- Read a VSCode extension manifest and identify pretrust execution surfaces
- Recognize the killchain stages (infiltration, trigger, primitive, escalation, trust bypass) in any IDE extension they encounter
- Inspect any installed extension's webviews at runtime, attach a debugger to its extension host, and read its on disk source on any VSCode fork
- Apply indirect prompt injection to LLM backed extensions specifically, including via workspace settings, project files, and custom file formats
- Understand the difference between webview side XSS and host side RCE, and how the extension API bridges them via
postMessage - Know which classes of these bugs are typically in scope for bounty programs and generally understand the target threat model
A laptop with VSCode 1.95+ (or Cursor, or VSCodium) and Node 20+. Familiarity with JavaScript and JSON. Some shell. No prior extension development experience required. Internet required to download the VSIX or build from source if you don't already have it. Everything runs locally.
One hour. This is flexible and it could be made longer. Workshop will be a mix of instructor lead content and self paced breaking working session where I walk around and "engage" people and answer questions.
We will walk through several vulnerabilities that lead to full chain code execution in the example Nopilot VSCode extension that are inspired by real bug bounty findings. This will include XSS in custom webviews leading to full code execution when a workspace loads and processes a configuration file before the trust prompt is even interacted with, smaller gadgets that lead to larger impact when chained together, and several alternate paths due to unique bugs to achieve the same impact.