VSCode's SSH Agent Is Bananas

Microsoft's Visual Studio Code (VSCode) is working on integrating its SSH Agent feature into its remote editing system, as the platform is widely used and increasingly being leveraged in conjunction with large language models (LLMs) that generate code. However, there is a concern that this iterative development process, where the LLM generates code, the agent scaffolding runs the code, and the code generates errors that are fed back to the LLM, should not occur on users' development laptops.

This is because LLMs have "boundary issues," and they may inadvertently modify system configurations or even compromise Git projects being worked on.

The goal is to establish a "closed-loop agent-y (agentic) configuration" for LLMs, running within a clean-slate Linux instance that can spin up quickly and doesn't pose any risks. To achieve this, VSCode has borrowed a concept similar to Emacs' "Tramp," which allows remote editing systems to run Bourne shell commands and extend Emacs functionality.

However, unlike Tramp, VSCode mounts a full-scale invasion: it runs a Bash snippet stager that downloads an agent, including a binary installation of Node. The agent operates over a port-forwarded SSH connection and establishes a WebSockets connection back to the running VSCode front-end.

This setup raises security concerns, and the underlying protocol on this connection falls under the "murid" category in the security world. While the specifics of this classification are not mentioned, the author expresses misgivings about allowing VSCode remote editing on development servers and would be highly concerned if this were to happen during an incident on a production system. Despite these concerns, it appears that VSCode remote editing of Fly Machines can be configured without much deep technical understanding.