VS Code Token Theft & Cisco’s 7th Zero-Day

Week two of June 2026 pushes the attack surface in three directions at once: downstream into developer desktops, outward into network edge gear, and upward into the AI agents themselves. The common thread — credentials and code that defenders implicitly trust — is exactly what attackers are monetizing.

Critical: VS Code One-Click GitHub Token Theft

A researcher disclosed a technique against Microsoft’s VS Code that steals a developer’s GitHub authentication token with a single click — no further interaction after opening a malicious link or installing a crafted extension. The poison is in the plumbing: VS Code stores GitHub credentials locally for its integrated auth flows, and a malicious path to those secrets means read/write access to every repository the victim can touch, including CI/CD pipelines and production-adjacent code.

At the time of reporting the flaw was unpatched and the PoC was disclosed without coordinated release, which makes the defensive moves immediate and mechanical:

• Audit installed VS Code extensions — remove anything unverifiable or unmaintained;
• Revoke and regenerate all GitHub tokens that VS Code or its extensions use;
• Watch GitHub audit logs for anomalous repo access, PAT creation, or workflow edits;
• Prefer ephemeral, environment-injected tokens over editor-stored credentials;
• Treat developer tooling as production infrastructure — it is one `git push` away from it, as the node-ipc incident and wider supply chain crisis already proved.

High: Cisco SD-WAN’s Seventh Zero-Day of 2026

CVE-2026-20245 allows arbitrary command execution as root on affected SD-WAN devices and remains the seventh Cisco SD-WAN zero-day exploited this year. As we noted in last week’s intel, there was no patch at disclosure, so the playbook is architectural: keep management interfaces off the internet, segment the SD-WAN control plane from everything else, monitor controller command logs, and press Cisco TAC for emergency fixes. Edge devices as the breach point is the year’s most reliable pattern — the same geometry behind the BlueHammer/RedSun perimeter compromises and the broader 2026 zero-day surge.

WordPress Under Fire: Kirki and Burst Statistics

Two widely deployed plugins are being actively exploited in the wild — not theoretically scanned, actively attacked:

• Kirki Customizer Framework — privilege escalation that can hand attackers administrative access;
• Burst Statistics — authentication bypass enabling full site takeover.

Patches are available, which turns this from an emergency into a fifteen-minute chore with a deadline. Update both if installed, then check the `wp_users` table for unfamiliar admins and diff user roles for elevation. WordPress plugin exploitation remains one of the highest-ROI attack vectors on the internet precisely because patch latency is measured in weeks for most estates.

100 AI Agents Tested: The AI Risk Quadrant

A comprehensive study put 100 AI agents through security testing and ranked them on an AI Risk Quadrant across three axes: how easily the agent can be compromised, the blast radius if it is, and the strength of built-in defenses. The headline finding is blunt: most agents showed significant security gaps.

This is the empirical backing for what the frameworks have been warning about all year — the agentic attack surface is real, and it is growing faster than most security programs are adapting. If you deploy agents in any business process, the study’s three axes make a usable scorecard: inventory your agents, rate each on compromise-likelihood, impact, and existing controls, and remediate the top-right quadrant first. The OWASP Top 10 for Agentic Applications and guidance on securing multi-agent systems are the templates; threats like agent persistence attacks are what you’re defending against.

Also This Week: Voice Hijack and the Agent-Security Funding Wave

Two stories we flagged in week one developed further. The Gemini voice assistant notification hijack — steering assistant actions via crafted messages, from smart-home control to Zoom calls — hardened the case that notification channels are implicit trust boundaries. And the funding market confirmed agent security is now its own category: Willow (formerly Webrix) emerged from stealth with an enterprise platform for governing AI agent access, and Offroad raised $7M to apply autonomous agents to identity risk — security AI securing AI, the meta-pattern of 2026.

The Week at a Glance

Frequently Asked Questions

How does the VS Code GitHub token theft work?

The technique abuses VS Code’s extension and auth architecture: a malicious link or crafted extension reaches the GitHub authentication token stored locally by the editor, exfiltrating it with a single click. The stolen token grants the attacker the same repository read/write access as the victim developer — including CI/CD-adjacent code.

Why does Cisco SD-WAN keep shipping zero-days?

SD-WAN controllers concentrate routing policy, encryption keys, and management access on internet-adjacent appliances — a high-value, high-exposure combination. Seven exploited zero-days in 2026 reflects attackers’ focus on edge infrastructure as the primary breach point; segmentation and management-plane hygiene are the mitigations that survive every individual CVE.

Which WordPress plugins are being exploited this week?

Kirki Customizer Framework (privilege escalation to admin) and Burst Statistics (authentication bypass to site takeover). Both have patches available — update immediately if installed, then audit for unauthorized admin accounts and role changes.

What did the 100 AI agents security study find?

Most of the 100 agents tested showed significant security gaps. The study’s AI Risk Quadrant rates each agent on vulnerability, impact, and defense strength — a practical scoring model organizations can replicate to prioritize which of their own agents to harden first.

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”How does the VS Code GitHub token theft work?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”A malicious link or crafted extension reaches the GitHub authentication token stored locally by VS Code and exfiltrates it with a single click, granting the attacker the victim developer’s repository read/write access.”}},{“@type”:”Question”,”name”:”Why does Cisco SD-WAN keep shipping zero-days?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”SD-WAN controllers concentrate routing policy, encryption keys, and management access on internet-adjacent appliances. Seven exploited zero-days in 2026 reflects attacker focus on edge infrastructure; segmentation and management-plane hygiene remain the durable mitigations.”}},{“@type”:”Question”,”name”:”Which WordPress plugins are being exploited this week?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Kirki Customizer Framework (privilege escalation to admin) and Burst Statistics (authentication bypass enabling site takeover). Both have patches available and should be updated immediately.”}},{“@type”:”Question”,”name”:”What did the 100 AI agents security study find?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Most of the 100 AI agents tested showed significant security gaps. The study’s AI Risk Quadrant rates agents on vulnerability, impact, and defense strength, providing a practical scoring model for organizations to prioritize hardening.”}}]}

References

• Researcher disclosure — VS Code GitHub token theft technique (PoC, uncoordinated)
• Cisco — SD-WAN security advisory, CVE-2026-20245
• WordPress — Kirki Customizer Framework & Burst Statistics plugin advisories
• AI Risk Quadrant — 100-agent security study
• Hmmnm — Weekly Threat Intel June 2026 · W1
• Hmmnm — Agentic AI Security: The New Attack Surface
• Hmmnm — OWASP Top 10 for Agentic Applications 2026
• Hmmnm — Securing Multi-Agent Systems
• Hmmnm — node-ipc Supply Chain Attack 2026
• Hmmnm — Software Supply Chain Security
• Hmmnm — AI Agent Persistence Attacks
• Hmmnm — Defender Becomes the Door: BlueHammer & RedSun

The VS Code token chain, generalized

Token theft from developer tooling is the highest-yield attack class of the era, and the VS Code incidents illustrate the full chain: extensions and language servers run with filesystem and network access on machines holding cloud credentials, git tokens, and package-publishing keys — the git-credential and TeamCity lessons wearing an IDE logo. The malicious-extension surface compounds it: marketplace review is thin, extension updates are automatic, and a compromised popular extension reaches thousands of development machines at once.

The hardening stack for development environments: treat the dev machine as production — EDR, disk encryption, and no personal credential mixing; scope and rotate the tokens that live there (fine-grained, short-lived, per-repository where possible); control extension installation through enterprise policy with allow-lists rather than open marketplaces; and monitor for the exfiltration patterns — credential-file reads by non-tooling processes, unusual network destinations from IDE processes, and token-use anomalies at the platforms the tokens unlock.

The consolidation across this series: developer machines are the common upstream of nearly every supply-chain incident documented — Sisense, 3CX, XZ, and now VS Code cycles — and the sector is slowly, incident by incident, reclassifying them from productivity endpoints to critical infrastructure. The organizations that completed the reclassification early are conspicuously absent from the compromise reports; the rest are the dataset.

The reclassification completes with process, not products: developer machines join the asset inventory with the same criticality tier as build servers, their credential stores join the rotation schedule, their extensions join the allow-list policy, and their telemetry joins the detection baselines. One paragraph of policy; the entire upstream of this decade supply-chain incident record, secured.

One paragraph of policy securing the upstream of a decade of incidents — the best ratio of effort to blast radius available in current security practice, and available to any organization this week.

The token-theft chain also inverts usefully for detection engineering: because the targets are known (cloud CLI profiles, git credential stores, IDE session tokens, package-registry keys), the telemetry to watch is enumerable — file-access patterns on credential paths, process lineage for token-consuming binaries, and authentication events at the platforms the tokens unlock. A detection suite built from that inventory covers the observed intrusion chains of this entire era, since the attackers keep selecting from the same small menu of credential locations. The menu is the detection map; publish it internally and point sensors at every entry.

Enumerate the menu, point sensors at every entry, and the credential-theft era converts from threat category to monitored surface — the detection map was hiding in plain sight inside the attackers own consistency.

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy