In May 2026, GitHub confirmed that an employee device was compromised through a poisoned VS Code extension, reportedly exposing approximately 3,800 internal repositories. The incident demonstrated a critical reality: an organization’s infrastructure does not need to be directly breached.
You might also like...
BlueFlag Security is a Developer Risk and Governance Platform, the system of record for developer identity risk and the tools those identities interact with. It gives security and engineering teams full visibility and governance over every identity operating in the development environment: human developers, non-human identities, and AI agents. BlueFlag connects read-only in under 5 minutes, never touches or copies code, and delivers a full findings report within 48 hours.
