Extensions and AI tools on company computers: the risks and how to manage them

The problem: one click, and it runs with your permissions

A browser extension, an editor plugin or a connector for an AI assistant installs in seconds, often without anyone else being involved. From then on it runs with the user's permissions: it reads open pages, active sessions, files, sometimes mail. And it updates itself.

On 30 October we covered the tampered Claude Code extension, which for 11 hours installed a backdoor on the computers of people using it in Cursor. It is not an isolated episode: over the last two years the same pattern has repeated with extensions used by hundreds of thousands or millions of people, and AI tools have widened the possible damage.

Eight cases in two years

We picked cases documented by verifiable sources, most recent first. The figures are those reported by the sources cited.

What they have in common

Behind such different cases, four patterns keep coming back. Knowing them explains why the rules in the next section look the way they do.

• The trusted tool that changes. Urban VPN, Cyberhaven, Nx and Claude Code were genuine tools, installed for a long time. One automatic update was enough to turn them. Store reviews and badges do not protect you: Urban VPN had both.
• The stolen developer account. Cyberhaven through a phishing email, LiteLLM through stolen publishing credentials: whoever controls the account publishes in the original author's name, and the updates reach everyone.
• The credible imitation. The postmark-mcp connector carried the name of a well-known mail service, but the real vendor had never published it: people installing it had no reason to doubt it.
• AI that widens the damage. An AI agent can read files, run commands and send email. In the Nx case the malware used the installed assistants to search for secrets; in the Amazon Q case the harmful instructions were written for the agent itself.

Why it matters even if you do not write software

Most of the cases involve developer tools, but the problem is everyone's. Almost every company computer has a browser with a few extensions the user installed: translators, ad blockers, free VPNs, AI assistants. Each one sees the pages of the management software, the bank and the webmail.

AI pushes the boundary further. Conversations with assistants often contain customer data, contracts and quotes: the Urban VPN case shows that an extension can collect them without the user noticing. And connectors that give the AI access to mail, documents and calendar are, for all practical purposes, software holding the keys to the house.

Then there are open sessions. In the Cyberhaven case the target was advertising accounts: anyone running campaigns or payments from the browser is a target without writing a single line of code.

What to do in your company

You do not need to ban everything. You need to know what is installed, decide what is allowed and limit what a compromised tool can reach.

1. 01

   Take an inventory

   Which extensions are in browsers and editors, which AI assistants and connectors people use, with which accounts. Often this is the first time anyone has looked.

2. 02

   Move to an allowlist of extensions

   The Google admin console can block all extensions except approved ones, while letting users request new ones, and block those asking for sensitive permissions such as cookie access (Google). VS Code, from version 1.96, has a similar setting that can be pushed to company computers (Microsoft).

3. 03

   Stop users from freely consenting to apps

   The Cyberhaven case started with an authorisation granted to a malicious app. In Microsoft 365 every request can go through an administrator with the Entra ID approval workflow (Microsoft).

4. 04

   Set clear rules for AI tools

   Company accounts, not personal ones; customer data only in approved tools; connectors installed only from the vendor's own site. On machines with important data or access, AI agents do not get modes that skip confirmations.

5. 05

   Separate access

   People who administer servers or write code use separate accounts for sensitive operations. Keys and tokens with expiry dates and minimal permissions, not configuration files forgotten on disk: if a computer is compromised, the damage stays contained.

6. 06

   Control updates where it matters

   On machines with access to production, payments or health data, pin the versions of critical tools and update them after a few days, once any problems have surfaced.

7. 07

   Prepare the response

   Knowing in advance who isolates the computer, who rotates credentials from a clean machine and when to reinstall makes the difference between an incident lasting hours and one lasting weeks.

The rules on one page, for staff

For employees, the rules have to fit in a few lines. A starting point:

• Install only extensions on the company list; for a new one, ask rather than look for an alternative.
• No free VPNs, translators or "assistants" in the work browser: they are the most abused category.
• Customer and patient data only in approved AI tools, with the company account.
• A window asking you to authorise an app to access mail, files or calendar gets reported to IT before you accept.
• An email saying your account or extension breaks the rules and asking you to sign in through a link should be treated as phishing.

How we work

At Cloudfactory we manage servers, workstations, mail and accounts for companies, professional firms and healthcare providers. When we set up or review a network we start from an inventory of what is installed, configure browsers and consent from the console and separate administrative access from everyday access.

If you want to know which extensions and AI tools are running on your computers and how to bring them under control without stopping work, get in touch.

How we wrote this article

At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.

Frequently asked questions

Sources

1. Cloudfactory, Backdoor in the Claude Code extension (30 October 2026)
2. Comet, LiteLLM Supply Chain Attack
3. Malwarebytes, Chrome extension slurps up AI chats
4. BleepingComputer, Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
5. The Hacker News, First malicious MCP server found
6. StepSecurity, Nx build system package compromised
7. BleepingComputer, Amazon AI coding agent hacked to inject data wiping commands
8. Reco, Cyberhaven supply chain attack
9. Google, Allow or block apps and extensions
10. Microsoft, Manage extensions in enterprise environments (VS Code)
11. Microsoft, Configure the admin consent workflow