Why this analysis has no ERS
The source reports a vulnerability class spanning more than ten AI IDE products, over 30 findings, and 24 CVEs. It does not define one product version, workspace trust state, enabled native feature set, agent tool policy, or deployment boundary from which a single IVP/ORP/ACI result can be calculated. Selecting one representative configuration would require an assessor choice not made by the source, so the analysis is preserved with its AIDEFEND routes but carries no ERS.
Classification: Validated Research · source date 2026-08-05
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-017.002 | Least-Privilege Tool ArchitectureAIDEFEND dataVersion 2026.08.05. Give the coding agent allowlisted, typed, single-purpose capabilities instead of broad filesystem, shell, HTTP, or native access. Separating ordinary source edits from sensitive settings, workspace-root changes, executable files, and OS integration removes the combination of powers that IDEsaster chains require. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-5 Cn-7 |
| AID-H-019.001 | URL Normalization & Allowlist FilteringAIDEFEND dataVersion 2026.08.05. Route every IDE background fetch, including schema loading during preview, through one safe-fetch service that canonicalizes the URL, resolves and pins the destination, checks redirects and private ranges, and allows only approved hosts. Placement is decisive: filtering only the agent's HTTP tool leaves the base IDE's schema request untouched. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-1 Cn-3 Ro-1 |
| AID-H-018.001 | Tool Parameter Constraint & Schema ValidationAIDEFEND dataVersion 2026.08.05. Define a strict file-operation schema that rejects unknown fields, path traversal, workspace escapes, and writes to high-risk targets such as .vscode , .idea , *.code-workspace , executable hooks, or equivalent product configuration. This blocks the specific write primitives before the IDE consumes them. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.08.05. Before any write or preview side effect, independently present and approve the exact target, content digest, workspace change, executable binding, and expected network effect. Binding approval to the canonical action prevents a generic “approve file edit” dialog from authorizing a different setting or a fetch that already occurred. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.08.05. Inventory the exact IDE, coding assistant, extension, and embedded runtime versions in use; reconcile each product with its own advisories; stage fixed releases; and use endpoint readback to verify that vulnerable builds have exited. The 24 CVEs span different products and cannot be closed by citing one representative version. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-4 Tr-4 |
| AID-I-007 | Client-Side AI Execution IsolationAIDEFEND dataVersion 2026.08.05. For Electron or native desktop products, expose only named, allowlisted capabilities across the native bridge and reject arbitrary IPC, filesystem paths, Node globals, or generic native calls. This can separate the AI runtime from base-IDE and OS authority, but it applies only where the client architecture provides an enforceable bridge boundary. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-1 Cn-4 |