For most developers, yes: keep extension auto-update on, because fixes arrive without effort. For a team, add guardrails: an allowlist of approved extensions, publisher trust checks, and a known way to install an older version when an update breaks something. Auto-update is a patch channel, but also a delivery channel.
What VS Code does by default
The VS Code documentation says VS Code checks for extension updates and installs them automatically. You can turn that off globally with the Disable Auto Update for Extensions command, or per extension by right-clicking it and toggling Auto Update. Administrators can manage the extensions.autoUpdate setting through enterprise policies.
Why this deserves a decision
The extension runtime security page is blunt: the extension host has the same permissions as VS Code itself. An extension can read and write files on your machine, make network requests and run external processes.
That means an extension update is code that runs with your user rights. Auto-update is the reason a fixed bug reaches you fast. It is also the reason a bad release reaches you fast. Neither fact cancels the other.
What the marketplace checks for you
The documentation lists several protections:
- Malware scanning by multiple antivirus engines before publication
- Dynamic detection, where extensions run in a sandbox to observe behavior
- Verified publisher marks, which show proven domain ownership
- A block list, with VS Code uninstalling reported malicious extensions
- Signature verification at install time
Those are useful. They are not a promise that every update is safe, so they sit beside your own controls, not in place of them.
Choosing a policy
| Situation | Reasonable setting |
|---|---|
| Solo developer or small team | Auto-update on |
| Team with a written allowlist | Auto-update on for approved extensions only |
| Regulated or high-trust environment | Auto-update managed by policy, reviewed on a schedule |
| An extension broke after an update | Turn auto-update off for that one and pin the older version |
Rolling back one extension
Right-click the extension and choose Install Another Version, then pick from the list. Then disable auto-update for that extension so it does not jump forward again. Write down why, and add a date to revisit.
Trust prompts matter
Since VS Code 1.97, installing from a third-party publisher shows a dialog asking you to confirm you trust that publisher. Extensions installed through the command line do not get automatic trust. Read the prompt instead of clicking through.
Related reading: how to control VS Code updates across a team.
Safeguard offers IDE extensions of its own, and its policies and dependency scanning cover the code you build, not the editor itself. A free scan is at gold.safeguard.sh/scan.
Common mistakes
Teams often turn off auto-update after one bad release and never turn it back on. Others install from the command line and skip the trust prompt. A third mistake is keeping extensions nobody uses, which still run with full permissions. Review the installed list each quarter and remove what is idle.
Quick check
How do I stop one extension from auto-updating?
Right-click the extension in VS Code and toggle the Auto Update item off.
Do extensions run in a sandbox?
According to the VS Code documentation, the extension host has the same permissions as VS Code itself, so extensions are not limited to a small permission set.
Sources
Last reviewed: 19 October 2026.
