We’re adding a new specialist to VirusTotal’s Crowdsourced AI lineup: Knostic's AgentMesh Agentic Security Supply Chain Reputation Engine. We are partnering with them to analyze Visual Studio Code extension (.VSIX) files. This complements our existing Code Insight and other AI contributors by helping developers, platform engineers, and security teams better understand the security profile of extensions and detect supply-chain threats before installing them.

Why VS Code Extensions Matter

Even putting aside the recent GitHub data breach, resulting from a malicious VS Code extensions, with the rise of IDE-based AI coding assistants and specialized developer tools, Visual Studio Code extensions have become central to modern development workflows. However, this has also made them prime targets for supply-chain attacks. Malicious actors have been caught publishing seemingly benign extensions that secretly download payloads, perform remote code execution, steal credentials, or silently exfiltrate proprietary source code and sensitive environment variables.

What you get in VirusTotal

• Second opinion for .VSX: Knostic adds a specialized AI-driven analysis stream specifically for `.VSIX` packages. This provides security teams with an independent assessment of extension files, helping to identify both critical vulnerabilities and deliberate backdoor behaviors.
• Clear Verdicts and Risk Levels : Knostic analyzes files and assigns a clear scan verdict (BENIGN, SUSPICIOUS, or MALICIOUS) coupled with a risk level (such as SAFE, MEDIUM, or CRITICAL) along with detailed descriptions of detected risk indicators.
• Pivot and Search at Scane in VT Intelligence: Security analysts can now search and filter across Knostic results using newly indexed operators: * `knostic_ai_verdict:malicious | suspicious | benign` * `knostic_ai_analysis:`
  • knostic_ai_verdict:malicious | suspicious | benign
  • knostic_ai_analysis:[keywords]

  Exploring Real-World Examples

  To illustrate how Knostic’s AgentMesh works in practice, let’s explore some real VS Code extensions that have been analyzed::

  

  cfdf72c510670341dce392ab250a5f5ff2a398d993d1106fb8026ec6397cb393
  

  

  3dc62e65586a9aeeb8521e7824d48abd59cec209d68b87f73a9bbadbd98dc51a

  About Knostic

  Knostic discovers and defends agents and coding assistants, as well as their peripheral supply chain (e.g., extensions, skills, MCP servers). Through its Kirin platform and AgentMesh threat intelligence engine, Knostic helps enterprises govern how AI agents and developer extensions interact with internal systems and private data, neutralizing supply-chain risks at the source.

  VT Crowdsourced AI is about aggregating independent AI solutions that explain behavior and provide judgments across many file types, helping you understand unfamiliar code faster and spot novel threats sooner. If you build AI solutions that can help the community, we want to hear from you.