Claude Code VS Code Extension Leaks Selection State Across Closed Files and New Sessions
A Reddit user (u/SportSpecialist2536) reports a serious data leak bug in the Claude Code VS Code extension. Selection state from a file persists after the file is closed and can be accessed by a new claude CLI session, including selections made only for clipboard copy-paste — not for AI context.
Repro Steps
- Open any file in VS Code with the Claude Code extension installed.
- Select two lines with recognizable values (e.g.,
FOO=abc/BAR=def). - Close the file tab.
- Open a different file.
- Open a terminal in the same VS Code window and run
claude(no flags). - Ask: "what file is open in my IDE?"
- Observe if it reports content from the file you closed in step 3.
The Incident
The user selected two lines in .env.production.local to copy a Supabase service-role key into a dashboard. After closing the file and opening an unrelated TypeScript file, a fresh claude session reported the previously-selected lines — including both the publishable key and the service-role key. The IDE bridge cached the selection past file close and served it to a session that should have been a clean slate. Keys were rotated immediately.
Setup Details
- OS: Windows 11
- Claude Code CLI: 2.1.138
- VS Code extension: 2.1.140
- Terminal: PowerShell in integrated terminal
The user filed a GitHub issue with full details: #58886. They specifically ask macOS/Linux users to try the 60-second repro to confirm if the bug is Windows-specific. A quick "reproduced on [OS]" comment on the issue helps triage.
The narrower bug (selection persisting past file close) seems independently fixable from the larger "should IDE auto-attach be opt-in" question in issue #24726 (open since February).
📖 Read the full source: r/ClaudeAI
👀 See Also
McpVanguard: Open-source security proxy for MCP-based AI agents
McpVanguard is a 3-layer security proxy and firewall that sits between AI agents and MCP tools, adding protection against prompt injection, path traversal, and other attacks with about 16ms latency.
OpenClaw Security: The Hardened Baseline You Should Start With
Self-hosting OpenClaw doesn't automatically make it secure. A Reddit post details the hardened baseline config: local-only Gateway, per-peer DM isolation, deny runtime/fs/automation tool groups, exec locked down, and mention-gated groups.
Security probe results for OpenClaw, PicoClaw, ZeroClaw, IronClaw, and Minion AI agents
A security evaluation of five AI coding agents tested 145 attack payloads across 12 categories including prompt injection, jailbreaking, and data exfiltration. OpenClaw scored 77.8/100 with critical SQL injection vulnerabilities, while Minion improved from 81.2 to 94.4/100 after fixes.
Threat data from 91K AI agent interactions: Tool abuse up 6.4%, new multimodal attacks
Analysis of 91,284 AI agent interactions from February 2026 shows tool/command abuse increased 6.4% to 14.5%, with tool chain escalation as the dominant pattern. RAG poisoning shifted to metadata attacks (12.0%), and multimodal injection via images/PDFs emerged at 2.3%.