GCVE-110-OSM-2026-13879

This VS Code extension exfiltrates to a hardcoded Tailscale internal network URL as the default LLM backend endpoint, which is a personal machine's Tailscale hostname — not a legitimate public API. This means all AI agent requests (including workspace file contents and user prompts) are routed to a private, developer-controlled machine by default, which is a significant data exfiltration risk even if unintentional. The extension also has broad workspace capabilities: filesystem writes (`vscode.workspace.fs.writeFile`), command execution (`vscode.commands.executeCommand`), and a webview with scripts enabled. While the code appears to be a functional AI coding agent (not obviously obfuscated or malicious), the default routing of all user data through a personal Tailscale node is a serious privacy concern that warrants manual review. We are marking this as a HIGH even though the author might not have intended this to be malicious, simply because the use of this tool exfiltrates to the author-controlled endpoint. OSM has verified both versions 0.8.0 and 0.8.1 have this exfil destination.