Hijacking Claude Code via Injected Marketplace Plugins

Somewhat tangential but I’m curious how people are dealing with these new LLM addons (mcp, extensions for vscode, now CC plugins) at big orgs.

I’ve been using it for personal projects but surely large companies have _some_ way they’re trying to prevent security issues? For instance, I remember one company I worked at blocked us from installing VSCode extensions.