BUILD / AI & Software
How to use free AI coding models in VS Code—safely.
A simple guide to extensions, providers, routers, permissions, and what should never leave your machine.
AI coding assistants can explain unfamiliar code, find bugs, generate tests, refactor repetitive logic, and—in agent mode—act across an entire project.
Free tiers, free credits, and open models make those capabilities easier to try without another monthly subscription. But the convenience can hide the most important detail: you may be giving third-party software access to source code, configuration, terminal output, and the ability to create files or execute commands.
That does not mean you should avoid these tools. It means you should understand what you are connecting before pasting an API key into VS Code and clicking Allow.
01 / The connection
First: what are we actually building?
Imagine ordering something online. You are the customer. VS Code is your desk. The coding extension is the assistant beside you. The API is the telephone. The provider or router operates the telephone network. The AI model is the expert on the other end of the call.
The response travels back through the same path to your editor.
If you ask why a function is failing, the extension gathers the context the model needs. That may be the function, a related file, an error message, or more of the project. It sends that information through the API and displays the answer that comes back.
In agent mode the same flow can go further. The tool might search the repository, edit line 32 itself, create files, run tests, install packages, or invoke external services. You are no longer using a fancy autocomplete box. You are potentially giving software the ability to act inside your development environment.
02 / The vocabulary
The three pieces people commonly confuse
“I’m using Kimi in VS Code” can describe several different organisations and products. Separating them is essential when you assess security or privacy.
The extension
The interface inside VS Code. It decides which files can become context, whether AI can edit, run commands, store conversations, or call tools.
The API provider
The service the extension contacts. It may operate the model directly or route the request to another provider—adding one more party to the data path.
The AI model
The system processing the request. Changing the model does not necessarily change the extension, provider, router, or where information is processed.
API
A structured way for two pieces of software to communicate.
API key
A credential that can authenticate requests, consume usage, incur charges, or access services. Treat it like a password.
API router
One interface for many models. Convenient, but another organisation that may process or log the request.
Never place an API key directly in source code that will be committed to Git. If a key is exposed, revoke it and create a new one. Before using a router with important code, check its ownership, retention, training policy, downstream providers, processing locations, deletion controls, and security documentation.
03 / Setup
How to connect an AI model to VS Code
Buttons and labels change, but the underlying process is consistent. Use current first-party instructions rather than a video that may contain retired model names or copied endpoints.
- 01
Choose the model
Compare coding ability, reasoning, context, speed, limits, and whether the offer is permanently free, promotional, or introductory credit.
- 02
Choose the access path
Connect directly to the model provider, use an API router, or run a model locally. Every additional service becomes another trust decision.
- 03
Configure the extension
Use the provider’s current Base URL, a dedicated API key, and the exact model ID. Verify each value in first-party documentation.
- 04
Open a disposable project
Learn what the extension reads, which approvals it requests, and whether it can edit files or run commands before opening valuable code.
- 05
Add permission slowly
Begin with explanation and suggestions. Grant editing, terminal, network, or external-tool access only when the task genuinely needs it.
Use the maintained documentation
Two links worth bookmarking
- Kilo Code: custom models and providers
Current steps for provider type, Base URL, API key, and model selection.
- VS Code: Workspace Trust and Restricted Mode
What VS Code limits while you assess unfamiliar project contents.
Direct provider access usually makes the data flow easier to understand. A router may be cheaper or more flexible but adds another service to evaluate. A local model can reduce external exposure because code may stay on infrastructure you control, although “local” is not an automatic guarantee that every piece of software involved is safe.
04 / The boundary
Safe / caution / don’t do this
The safest configuration is not defined by the model name. It is defined by which information is allowed to cross the edge of your machine and which actions require approval.
VS Code and the extension operate inside the machine. A context gate decides what may continue to an external router and model. Environment files, production credentials, and customer data remain blocked.
- .env
- Production credentials
- Customer data
Disposable code, public docs, narrow context, limited keys.
Private source, repository structure, logs, or terminal output.
Production secrets, customer data, or unrestricted credentials.
The best secret for an AI agent to protect is one it never had access to.
05 / Security
The biggest question: what can the AI actually see?
Installing an extension does not necessarily upload every file on your computer. What is transmitted depends on the extension, task, selected tools, and configuration. But the potential context is broad: source code, filenames, project structure, nearby files, terminal output, stack traces, logs, Git changes, documentation, configuration, and information retrieved by agent tools.
Secrets need their own boundary
Projects frequently contain database passwords, API keys, tokens, private certificates, cloud credentials, signing keys, and service-account credentials. Keep them outside source code through environment variables and secret-management systems.
.gitignore is not an AI privacy control. It prevents Git from tracking a file; it does not automatically stop an extension or agent from reading that file. Use the tool’s own ignore and context-exclusion controls as well.
The extension is part of the attack surface
The model is not the only software you are trusting. Microsoft notes that extensions can read and write files, make network requests, run external processes, and modify settings. Its guidance on extension runtime security is a useful reminder that marketplace availability is not the same as a complete security review.
VS Code created Workspace Trust because merely opening a project can lead to unintended code execution. Restricted Mode disables or limits AI agents, terminal access, tasks, debugging, workspace settings, and extensions while you inspect an unfamiliar folder. Microsoft also states the limit clearly: Workspace Trust cannot protect you from a malicious extension that ignores it.
Agent permissions are security permissions
An agent that can edit files, delete files, execute shell commands, install packages, make network requests, or use external tools has a much larger blast radius than a suggestion tool. “Install everything this project needs and run it” can automate a malicious installation script just as efficiently as a legitimate one.
Prompt injection makes that especially important. Instructions hidden inside a repository, README, issue, web page, or retrieved document can try to manipulate the agent. VS Code’s own guidance on security for AI-powered development recommends treating project content and agent tools as connected trust boundaries.
06 / Evidence
Why “it’s in the Marketplace” is not enough
Published research supports keeping this section strong rather than treating it as a generic disclaimer. The numbers describe detected exposure or suspicious behaviour—not a verdict that every flagged extension is malicious.
8.5%
2,325 extensions were exposed to potential credential-related leakage vectors through commands, user input, configurations, storage, and related interactions.
Protect Your Secrets (Liu et al.)~5.6%
A combination of static and dynamic analysis reported suspicious behaviour that could affect development integrity or expose source code and personal information.
Developers Are Victims Too (Edirimannage et al.)They do not mean 8.5% or 5.6% of marketplace extensions are proven malware. The studies used different methods and risk definitions. They demonstrate that extension presence in a marketplace should not substitute for publisher, permission, code, behaviour, and organisational review.
07 / Controls
A safer setup for personal projects
- Install extensions only from publishers you have verified.
- Keep VS Code Workspace Trust enabled.
- Test the extension in a disposable repository first.
- Use a separate API key specifically for your IDE.
- Give that key the lowest privileges available.
- Set spending limits where the provider supports them.
- Never hard-code API keys or commit them to Git.
- Exclude .env files, certificates, and credentials from AI context.
- Require approval before terminal commands.
- Require approval before destructive file changes.
- Review diffs before accepting AI modifications.
- Do not blindly execute generated shell commands.
- Do not give the agent production credentials.
- Do not connect production databases.
- Do not paste customer information into prompts.
- Keep dependencies and VS Code extensions updated.
- Remove extensions you no longer use.
- Rotate or revoke API keys you no longer need.
AI-generated code is untrusted code until you have reviewed it.
Businesses need an approved path
Hobby code and company systems have different consequences. Proprietary source, client work, financial or healthcare systems, employee information, and unreleased products may be governed by contracts, privacy law, data residency rules, security frameworks, and intellectual-property terms.
Employees should not connect an unapproved provider to company repositories simply because it offers a free model. A business policy should answer these questions before a tool receives code.
Approved extensions
Which IDE extensions have completed review?
Approved providers
Which organisations may process company code?
Permitted data
Can proprietary code, logs, or customer data be submitted?
Retention & training
Are prompts stored, for how long, and used for training?
Agent permissions
Can AI run commands, install packages, or access networks?
Authentication
Are credentials organisation-controlled and individually scoped?
Monitoring
Can the organisation see which AI services touch company systems?
Incident response
Can access and credentials be revoked quickly?
Should I use a free AI router?
For learning and non-sensitive personal projects: potentially, yes. For a private production repository, apply a different standard. Verify ownership, privacy terms, retention, training, downstream model providers, security documentation, processing locations, and breach procedures. If you cannot determine what happens to the information you send, assume sensitive information should not be sent.
08 / Translation
AI coding thesaurus
- AI model / LLM
- The system doing the reasoning and generating the answer.
- API
- A structured way for two software systems to communicate.
- API key
- A password-like credential that lets software use an account or service.
- Endpoint
- The network address where an API accepts requests.
- Base URL
- The main address telling an extension where the AI service lives.
- API router
- A middleman connecting one coding tool to different AI models.
- Provider
- The company operating an API, router, or model service.
- Token
- A small unit of text the model reads or generates.
- Context
- Everything the AI is allowed to look at for the current request.
- Context window
- How much information the model can keep on its desk at once.
- IDE
- The application developers use to write and work with code.
- Repository
- A project’s code files together with their version history.
- Agent
- AI that can perform actions with tools, not only suggest an answer.
- Tool calling
- Giving the AI buttons such as read file, edit file, or run command.
- Terminal / shell
- A powerful text-based control panel for a computer.
- Environment variable
- A setting or secret supplied outside the source code.
- .env
- A file that commonly stores environment variables and sensitive values.
- .gitignore
- A list telling Git what not to track—not an AI privacy control.
- Least privilege
- Giving software only the access it needs for the current job.
- Sandbox
- An isolated environment that restricts what software can reach.
- Prompt injection
- Hidden instructions trying to manipulate an AI through content it reads.
- Telemetry
- Usage or diagnostic information software sends to its developer.
- Open source
- Software whose source can be inspected; not an automatic security guarantee.
- OpenAI-compatible
- An API format—not proof that OpenAI operates or endorses the service.
- Data retention
- How long a service keeps what you submitted.
- Data residency
- The countries where information may be stored or processed.
- Secret
- Credentials, tokens, or keys that could grant unauthorised access.
09 / The rule
What I would never give an AI coding agent
- Production .env files
- Database passwords or dumps
- Private SSH or cryptographic keys
- Cloud administrator credentials
- Signing certificates
- Customer exports or payment data
- Broad GitHub personal access tokens
- Authentication cookies
If everything this tool can see accidentally became visible to somebody else tomorrow, what would the damage be?
If the answer is “nothing really—it’s my experimental weather app,” your risk is relatively low. If the answer includes source code, customer data, production credentials, or an unreleased product, stop and change the architecture.
AI coding tools are extraordinarily capable, and free or open models are making that capability accessible to almost everyone. That is a good thing. The safest approach is not to avoid them; it is to understand the complete chain, know which organisations sit inside it, know which permissions you have granted, and keep high-consequence information outside the system entirely.
Use AI like any powerful developer tool: experiment freely with things that are safe to experiment with, and put proper controls around the things that matter.
Sources & setup documentation