vscode news, stories and analysis

Radar chart showing the scope of Agent Plugins 1.0 across six dimensions. Four dimensions at full coverage: packaging, agent skills, MCP servers, and client extensions. Two dimensions at zero coverage: security model and distribution. The spec covers four areas and defers two.

Agent Plugins 1.0 unifies agent skills across five clients

Agent Plugins 1.0 is an open package format for portable AI agent skills and MCP servers. Five clients support it at launch, with no install or permission model.

Lars Cornelissen · Aug 7, 2026

VS Code Tasks supply chain attack affected 2 npm packages and 16 Go packages, according to JFrog Security Research.

Cyber security

VS Code Tasks supply chain attack needs new checks

VS Code Tasks supply chain attack is a package hijack pattern that can run outside npm lifecycle scripts, so scan editor configs now.

Lars Cornelissen · Jun 29, 2026

Copilot spend meter plan chart showing individual Copilot AI credit allowances: Pro 1,500, Pro+ 7,000, and Max 20,000.

Engineering

Copilot spend meter shows where AI coding costs bite

Copilot spend meter is VS Code's new warning for AI credit overruns. Treat the 1,500 Pro credits as a budget, not a perk.

Lars Cornelissen · Jun 23, 2026

VS Code Autopilot default risk shown through 2025 developer environment usage: Visual Studio Code at 75.9 percent, Visual Studio at 29 percent, Notepad++ at 27.4 percent, IntelliJ IDEA at 27.1 percent, and Vim at 24.3 percent.

AI

VS Code Autopilot puts agent risk in every default

VS Code Autopilot is now enabled by default, giving coding agents more autonomy. Treat the new default as a policy change, not a shortcut.

Lars Cornelissen · Jun 12, 2026