The AI coding agent that died in May is still one click away

Roo Code died on 15 May 2026. Its makers stopped supporting the AI coding agent, archived its code repository and moved on to another product. Five months later, Microsoft's Visual Studio Code Marketplace still offers it to anyone, one click away. On 15 October, the listing showed 2,078,718 installs, according to The Late City's check.

Since the shutdown, security researchers have published eight vulnerabilities in Roo Code's final version, 3.54.0. Every one is rated high severity. Every one describes a way to bypass the agent's command-approval checks, potentially allowing shell commands to run on a developer's computer without permission. None has received an official patch, because nobody is maintaining the extension anymore.

The comfortable assumption is that dead software stops being a problem. Roo Code shows the reverse. An AI agent that can act on your computer keeps working after its makers walk away. Researchers keep finding holes, but nobody ships fixes anymore.

How Roo Code lived and died

Roo Code started in late 2024 as a fork of Cline, an open-source AI coding agent that lives inside the VS Code editor. Developers could connect their preferred AI models and let the agent write code, edit files and execute terminal commands.

According to The New Stack, its appeal came partly from giving agents greater freedom to act without constantly asking for permission. The project grew into one of the more widely adopted coding assistants.

In April 2026, the company announced that the extension and its paid Cloud and Router services would shut down on 15 May. The team believed the future of coding agents lay beyond the editor and had begun building another product.

The shutdown went ahead. Version 3.54.0 became the final release, and the GitHub repository was archived. But there was no kill switch. Installed copies kept working, and the Marketplace listing remained available with a disclaimer announcing the shutdown and recommending two alternatives, Cline and a community fork called ZooCode.

There is an irony here worth holding on to. The autonomy that made Roo Code popular is precisely what its newly discovered vulnerabilities put at risk.

Eight holes after the funeral

Roo Code's command-approval system works like a bouncer with a guest list. Developers specify which commands the agent may run automatically and which must be denied or require permission. Before executing anything, a parser examines the proposed command against those rules.

The problem is that the parser and the shell executing the command do not always understand the same characters in the same way. Something the parser considers harmless can be interpreted by the shell as an instruction to execute another command. The safety check approves one thing, while the computer does something else.

Researchers describe how attackers could exploit this through indirect prompt injection. Malicious instructions planted in a repository file, documentation or a web page could influence the agent into proposing a command that slips through its own approval check.

The eight vulnerabilities published since Roo Code's shutdown are:

All eight affect version 3.54.0 and were assigned through VulnCheck, an authorised CVE Numbering Authority. Seven have accompanying public research reports demonstrating bypasses against the archived code.

The July vulnerability carries an official designation, unsupported-when-assigned, meaning the software was already out of support when the flaw received its identifier. CISA's assessment recorded an available proof of concept and potentially total technical impact.

There is a bleak joke in the paperwork. One vulnerability database advises users to update Roo Code to the latest version. The latest version is the vulnerable one.

The extension that never left the store

The most serious scenarios depend on one setting. Roo Code normally asks permission before executing terminal commands. But developers can enable automatic approval, allowing the agent to work without constantly stopping for confirmation.

That convenience is central to the appeal of autonomous coding agents. Yet with automatic execution enabled, a command that bypasses the approval check may run without the developer seeing another prompt.

This does not mean every Roo Code installation is vulnerable to exploitation under every configuration, nor do the published advisories establish that attacks have occurred.

The install base is substantial, although the Marketplace counter does not distinguish active users from people who installed Roo Code once and forgot about it. What matters is that the extension remains available for new installations five months after support ended.

New developers are still being directed towards it. Ollama's integration documentation tells users to install Roo Code from the Marketplace. Other installation guides remain online without explaining the known vulnerabilities.

Community developers have continued the project through forks. ZooCode, which the original Marketplace listing recommends, is actively maintained. But a fork is a different extension that users must seek out and install. Fixes made there do not reach the abandoned original.

The store itself has mechanisms for handling extensions that should no longer be distributed. Microsoft's publishing documentation allows publishers to unpublish an extension, preventing further downloads, or remove it entirely. Extensions can also be formally deprecated.

Roo Code's publisher has done neither. Its Marketplace listing remains available with a shutdown disclaimer and a general warning about the risks of using the software, but no specific mention of the eight published vulnerabilities.

Roo Code is not known to be malicious. A published vulnerability is also not proof that somebody has exploited it. But there is a difference between distributing software with a theoretical risk and continuing to offer an abandoned agent with documented ways to defeat its primary command-approval safeguards.

That difference matters because coding agents are not passive tools. They read files, encounter instructions, modify code and execute commands. Their usefulness depends partly on how much they can do without someone watching every action.

An old software library may sit unused until another program calls it. An abandoned coding agent can continue reading, deciding and acting long after its final security update. The permissions that made it useful do not disappear when its developers leave.

For anyone still using the original Roo Code extension, the practical response is to uninstall it and move to a maintained alternative. Disabling automatic command execution can restore a human approval step while migrating, but it cannot repair the underlying vulnerabilities.

The larger question belongs to the people distributing these tools.

A shutdown disclaimer tells developers that a product is no longer supported. It does not tell them what researchers have discovered since, whether those flaws will ever be fixed, or what that means before they click Install.

Roo Code's creators were entitled to move on. Community developers have continued parts of their work. But the original extension remains available, its documented security flaws remain unresolved, and the responsibility for warning the next developer falls somewhere between the publisher and the store.

Five months after Roo Code died, that gap is still open.