The tools developers trust to run agents needed trust fixes of their own

What broke

Microsoft shipped fixes in VS Code 1.145.3 on November 10, 2026, covering flaws in the editor developers use to run AI agents. A flaw, tracked as CVE-2026-120779, let a malicious MCP server place a clickable workbench command inside a VS Code notification, and clicking it could run code with the user's permissions. Microsoft assigned the flaw a CVSS 3.1 base score of 9.6. m:…8515

The same release fixed Workspace Trust bypasses. CVE-2026-121665 let untrusted workspaces bypass Workspace Trust by using unregistered settings, including flat dotted keys nested below registered object settings. CVE-2026-119985 let a workspace file served over HTTP or HTTPS be treated as trusted before the user made any trust decision. Microsoft assigned scores of 8.8 and 8.3 to the flaws. m:…8523 m:…8509

The release also fixed a flaw in the serve-web component, tracked as CVE-2026-120780, where the router performed release selection before authenticating the request. Exploiting it required a victim with an active, authenticated session to open a crafted link, and the patch adds SameSite=Strict cookie hardening to prevent cross-site request forgery. m:…8516

Away from the editor, Microsoft disclosed a critical flaw in Azure OpenAI, tracked as CVE-2026-119990, where a function ran without checking the caller's identity. Microsoft assigned a CVSS v3.1 base score of 9.8, and says it has fully mitigated the vulnerability, with no customer action required. m:…8511

The MCP thread

The thread running through the release is the Model Context Protocol, the layer that connects coding tools to outside systems. A malicious MCP server was the attack route in the highest-scored editor flaw, and the fix turns on how the editor handles server-controlled strings: the McpElicitationService fell back to a regular workbench notification when no chat session was available, and the notification renderer treated plain strings as linked text, allowing command URIs to be executed. Exploitation required the user to connect to an attacker-controlled remote MCP server. m:…8515

The governance problem around MCP servers is wider than any single flaw. Oak's write-up on governing MCP servers in the enterprise says credential sprawl risks arise from servers holding long-lived, shared tokens to downstream systems without clear ownership, and its survey found 109 machine identities per human, with 40% of machine identities having access to organizational data. Credential abuse appears in the attack chain of 39% of breaches, according to the 2026 Verizon DBIR. m:…7202

Oak's prescription is a lifecycle: inventory, owner, scope, usage review, expiry, and retirement, with each server and its tokens treated as an identity with an owner, scoped access, usage review, and an end date. Token passthrough is explicitly forbidden in the MCP authorization specification, and credentials should be owned by a named person or team accountable for the server, not its last developer. m:…7202

What to do now

The practical step is to update. The editor fixes shipped in VS Code 1.145.3, and the Azure OpenAI flaw needs no customer action because Microsoft mitigated it on infrastructure it hosts exclusively itself. There is no public detection content for the Azure OpenAI flaw, so a security write-up suggests reviewing access logs for unexpected unauthenticated activity against Azure OpenAI endpoints. m:…8515 m:…8511

The harder step is inventory. Microsoft reported that the Workspace Trust flaw in CVE-2026-121665 was not publicly disclosed or exploited at the time of publication, and its assessment of CVE-2026-119985 lists the vulnerability as not exploited and exploitation as less likely. But the pattern is the thing to audit, not any single CVE: untrusted content reaching trusted actions through settings, notifications and workspace files. m:…8523 m:…8509

Why it matters

The lesson from this release is that the boundary is not the model. It is the editor, the MCP server and the workspace file, and each of those needed a fix in the same release. The flaws were not in exotic research code. They were in the everyday surfaces developers already trust: a notification, a settings file, a workspace prompt that never appeared. m:…8515 m:…8523 m:…8509

For teams running agents in production, the implication is to treat MCP servers as managed identities with owners and expiry dates, the way Oak describes, and to assume any server an agent connects to can try to put a command in front of a user. The patch closes the holes. The inventory is the work that remains. m:…7202