Disclosed vulnerability
Claude Code IDE extensions accepted WebSocket connections from any web origin
AIR-2025-0046 AIR record · 2025-06-claude-code-ide-websocket
From the supporting source
Malicious websites to connect to unauthenticated local WebSocket servers, potentially enabling remote command execution.securitylabs.datadoghq.com
The record
Disclosed
2025-06-23
Vendor
Anthropic
Product
Claude Code for VS Code and JetBrains extensions
Risk domain
Privacy › Data exfiltration channels
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — the IDE extension accepted WebSocket connections from any origin
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Malicious website local websocket
Impact type
Data exfiltration, Source code disclosure, Limited code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Code VS Code extension 0.2.116-1.0.23 (including in Cursor, Windsurf and VSCodium forks); JetBrains plugin 0.1.1-0.1.8
Capability abused
Defense & remediation
Recorded defense
none - the local WebSocket server was unauthenticated and did not validate connection origin
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Claude Code for VS Code 1.0.24, patched 2025-06-13 and advised 2025-06-23
Taxonomy & references
Curator notes
CVSS 8.8. Any page the developer visited could connect to the extension's loopback WebSocket (WebSockets are not constrained by same-origin policy) and read arbitrary files, open-file lists, selections and diagnostics. Code execution was possible only in the narrow case of an open Jupyter notebook with an accepted prompt.
Supporting sources
Cite as
Enkrypt AI. "Claude Code IDE extensions accepted WebSocket connections from any web origin". AIR, AIR-2025-0046. https://agentincident.vercel.app/i/AIR-2025-0046/ (accessed 2026-10-19).