Is an AI ad extension safe to install?
Five checks you can run yourself, on any of them, including this one. None of them need you to trust the answer we give — that is the point.
These extensions pay you to show a sponsored line while a model is generating. To do that they have to sit very close to your editor and know when it is busy. That is a reasonable thing to want and an unreasonable thing to take on faith, because the same position that lets something show you an advertisement lets it read your work.
1. Does it modify another program on your machine?
This is the one that matters most. An extension can render in space the editor gives it, or it can edit another vendor’s installed files to put itself somewhere better. The second is invisible once done and survives until that program updates.
How to check. Note the size of the target extension’s bundle before and after installing an ad extension. On VS Code, extensions live in ~/.vscode/extensions. A file that grows by a hundred kilobytes after you install something else did not grow on its own.
A bad answer is any modification at all to a program you did not install from that vendor. It also means the ad extension cannot be listed on the VS Code Marketplace, whose policy prohibits modifying other extensions — so if something is distributed as a direct download rather than through the Marketplace, that is worth asking about.
2. Does it weaken a security setting?
A Content Security Policy is the rule about where a page may send data. Editors ship strict ones. Widening a CSP — for instance to permit connections to localhost — makes something possible that the vendor deliberately prevented, for every page in that window, not just for the advertisement.
How to check. Search the target extension’s files for connect-src and Content-Security-Policy and see whether the list matches what the vendor shipped.
3. How does it know a model is working?
Something has to detect the wait, and the honest range of answers is narrow. Reading your conversation tells it precisely — and means it is reading your conversation. Watching for the fact that a file changed tells it roughly, and reveals nothing.
How to check. Ask, and expect a specific answer. “We respect your privacy” is not one. “We watch modification times on this directory and never open the files” is, and it can be verified by reading the source.
What we do. We watch one directory per assistant for writes, and read filenames and timestamps only. The watcher never opens a file. If the directory is not where we expect, detection goes quiet and no ad is served — it fails towards showing nothing.
4. Does it show ads when nothing is happening?
The premise is that you are paid for a moment you were already spending. An extension that shows ads while you read, type, or sit idle has quietly changed the deal — and is billing an advertiser for attention nobody gave.
How to check. Install it, then do not use the assistant for ten minutes. Watch the slot. It should be empty. This is the easiest check on the page and the most revealing.
What we do. An ad appears only while a transcript is actively being written, stops within seconds of the answer finishing, and never accrues while the window is unfocused or you have been away. It counts only after 5 seconds on screen, verified against our clock rather than the client’s — so a client claiming more attention than time has passed is refused.
5. Can you check the code that is actually running?
Published source only helps if the thing you installed was built from it. The stronger property is a build you can reproduce: rebuild from a tag, compare the hash, and either it matches or you were given something else.
How to check. Look for a licence that permits reading and rebuilding, published checksums, and ideally build provenance attached to releases. Also check whether the extension updates itself outside the Marketplace — an auto-updater is a channel that can deliver code nobody reviewed.
What we do. The clients are MIT and the server is AGPL-3.0, so you may read, rebuild, fork and self-host all of it. The archives are byte-for-byte reproducible and CI fails if two builds of the same commit disagree. There is no auto-updater. Instructions are in the FAQ and the repository.
What none of this proves
These checks constrain the client — the part on your machine. They say nothing about what a server does with what it receives, and no amount of open source fixes that. The honest mitigation is to send the server as little as possible, so that the question matters less: which impression, how long, which surface, which country. Not who you are, not what you wrote.
Our privacy notice lists the whole set, and the terms say what happens to it.