Security issues on VS Code — page 2
Issues the maintainers labelled both platform:vscode and area:security.
112 issues · 33 open · 79 resolved (71%) · first seen Feb 23, 2026
Is this getting better or worse?
This class of problem is holding steady. 44 new reports in the last 90 days vs 43 in the 90 before — +2%. The open backlog peaked at 33 in 2026-10 and sits at 33 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
85 of these reports name the Claude Code build they were running, spanning 58 releases. Heaviest reporters:
- Claude Code v2.1.296
- Claude Code v2.1.263
- Claude Code v2.1.207
- Claude Code v2.1.185
- Claude Code v2.1.170
- Claude Code v2.1.72
- Claude Code v2.1.289
- Claude Code v2.1.287
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 79 closures. Of the 79 closures with a recorded reason, 9% were closed as completed and 72 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
12 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Workspace trust dialog never appears in the VS Code extension (shown via CLI), so project-scope plugins / project .claude/settings.json are silently skipped
- …ver load because trust can't be granted in-editor. The only workarounds are launching once via CLI per repo, or hand-editing in (undocumented; see 720). Related issues - 12227 (open) — same downstream consequence (untrus…
Found in the description of #67319 · resolved - [BUG] 2.1.193 VS Code extension (Windows, native): OAuth login fails "certificate has expired" — regression from 2.1.190
- …Encrypt chain), and adding the ESET root via does not help. Workarounds: (a) downgrade the extension to 2.1.190 ; or (b) remove/distrust the expired from the Windows certificate store (keeping ). Environment: Windows 10…
Found in the description of #71554 · resolved - Endless SecurityAgent prompt stack for "Claude Code-credentials": credential rewrite creates keychain partition mismatch, "Always Allow" can never persist (behavior persists after #41026 was closed as resolved)
- …minutes after login completes. Any manual repair (e.g. the workaround from 41026) that runs inside that window is silently overwritten. Reliable recovery (verified): drain the dialog stack with "Deny" → delete ALL match…
Found in the description of #87348 · still open - [FEATURE] Support VS Code-style ${input:id} secret prompts in .mcp.json for VS Code extension
- …Just click "OK" in the prompt Alternative Solutions Current workarounds tried: 1. System environment variables (current solution) — works but requires manual PowerShell setup per developer ( ) and a full VS Code restart…
Found in the description of #44158 · resolved - Read tool bypasses PreToolUse hooks and permissions.deny rules in VSCode extension
- What's Wrong? rules and PreToolUse/PostToolUse hooks are not enforced for the tool in the VSCode extension. Files that should be blocked by both layers are read successfully with f
Found in the description of #37540 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–112
Ranked by community engagement (reactions weighted over comments).
- [Bug] Manual approval of blocked action not persisting; [Credential Exploration] denial recurring on retry
- Model questions and then overrides explicit live instruction with generic skill procedure and prints secrets in plain text
- Legacy .claude/scheduled_tasks.json is loaded by the VS Code runtime, enabled: false is ignored, jobs fire as user prompts, and the file is rewritten on disk
- Forged background-task completion notifications injected into model context (absent from session transcript)
- [Bug] Cyber policy false positive on defensive security tool's own regression tests
- [Feature Request] Improve defensive security code review handling to avoid false positives on security APIs
- [Feature Request] Add /nuke command to delete client and server session copies on key compromise
- [Bug] Anthropic API Error: Claude 3.5 Sonnet Cyber Safeguards Blocking Legitimate Requests
- [Bug] Anthropic API Error: Overly aggressive cyber safeguard classification blocking legitimate vulnerability research requests
- Foreign third-party web-page content streamed into an in-flight assistant message (same requestId, +81s after reply ended)
- [Bug] Safeguard false positive flags legitimate AI-safety research workflow with valid cybersecurity authorization
- [BUG] Fabricated tool-call/tool-result blocks injected into conversation (VSCode extension)