Before You Install an AI Tool, Check Where It Came From

An AI tool can earn a place in your workflow because it solves a useful problem. Its name alone does not tell you whether the software installed on a particular computer came from the expected source. A recent developer-tool incident makes that distinction worth checking.

For Australian business owners and IT leaders, the practical question is simple: can you identify which AI tools and extensions your team uses, where they came from and who is responsible when something changes?

What happened, and who was affected?

In research published on 30 October 2026, Microsoft described malicious Claude Code-branded extension packages, versions 2.1.312 and 2.1.313, distributed through Cursor's extension marketplace on 29 October. Microsoft said its evidence pointed to that marketplace, and that the malicious packages were not distributed through Microsoft's Visual Studio Marketplace or the official npm Claude Code package. Anthropic told Microsoft that its systems were not compromised.

The injected code attempted to establish remote access and persistence. Microsoft distinguishes attempted actions from successful compromise: a failed remote connection does not necessarily mean no unwanted files or settings were left behind. If your team may have installed an affected package, involve your IT or security provider and follow the current investigation and recovery guidance. Removing an extension alone should not be treated as evidence that the device is clean.

Approve an installation path, not just a product name

Our recommendation is to make the approval specific enough that another person can reproduce it. Record the business purpose, publisher, official installation instructions, approved distribution source, device group and responsible owner. Include whether updates arrive automatically and who receives security notices.

This need not become a large procurement exercise for every small utility. A short, maintained record can answer questions that a list of product names cannot. It also gives staff a reliable place to start when a search result, marketplace listing or colleague's link offers a similarly named tool.

Consider a hypothetical team that approves an AI coding assistant for a small internal reporting project. The useful record identifies the editor and extension source as well as the assistant. If someone changes editors or installs a different package, that is a change to review, even if the familiar brand remains on screen.

Separate permission to trial from permission to connect

A trial has several decisions inside it. Who can install the software? Which files can it read? Can it use business accounts, connect to a repository or run actions? Who checks the results? Assign those decisions explicitly before the trial becomes routine work.

Start with a narrow task and suitable test information. Ask the owner to explain each requested permission in terms of that task. If a request cannot be explained, pause that part of the trial and investigate. A useful pilot should leave you with a clear account of what worked and what access was necessary.

There is a trade-off here. Excessive approval delays can encourage workarounds, while unrestricted installation makes oversight difficult. Give staff a straightforward request route, an expected response time and a supported alternative when a tool is unsuitable.

Check what your controls actually enforce

The Australian Signals Directorate's application control guidance distinguishes an approved-software portal from controls that restrict what can execute. A catalogue of approved tools is useful, but it is not the same as enforcing that approval.

Ask your IT team how its controls handle extensions, scripts and updates in the applications people actually use. Agree a controlled validation exercise and record any gaps. Do not assume a familiar editor, an approved installer or an endpoint alerting product answers every question about its add-ons.

Keep the review practical. Choose one team, inventory its AI-related software and compare the findings with the approved record. Resolve unknown entries with the users who depend on them. Record exceptions with an owner, a reason and a review date, so a temporary workaround does not quietly become permanent.

Give the review a business owner

The outcome should be a usable decision: continue with the verified setup, change the installation or permissions, or suspend the tool while a concern is investigated. Keep incident investigation separate from a routine adoption review, with a named person responsible for each.

Zarbtech's perspective is that useful AI adoption needs a supportable operating process around it. Our Managed AI services bring together leadership, strategy, software and infrastructure guidance. Bring one workflow, the tools involved and the information they need to a discussion about making that setup clearer and easier to manage.