VSCode's SSH Agent Is Bananas (2025)

TL;DR Highlight

VSCode Remote-SSH installs Node and an agent on the remote that can touch files and shells

Who Should Read

Developers planning to run LLM agents on a remote sandbox server via VSCode Remote-SSH

Core Mechanics

VSCode installs an agent on the remote
- Emacs Tramp only runs shell commands over the connection.
- VSCode runs a Bash stager that downloads an agent including a Node binary.
The agent can do a lot
- It connects back to your local VSCode over WebSockets via port-forwarded SSH.
- It can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself.
The author is nervous about production
- He'd be a little nervous about remote-editing on dev servers.
- He'd be apoplectic if it happened during a production incident.
LLM loops belong on a clean Linux box
- An agent loop runs code, feeds errors back to the LLM, and iterates, which is a semi-effective antidote to hallucination.
- He wants it on an instant clean-slate Linux instance, not a dev laptop.
Fly Machine connection didn't depend on this

Community Reactions

Opinion: it's a feature for remote dev
- Commenters on several teams used the extension extensively without issues.
- They say SSH access can be restricted to enforce guardrails.
Opinion: the reverse direction is the problem
- A compromised remote may execute code on the local machine.
- A commenter quoted the official extension's security notice saying so.
Opinion: sandboxes aren't really sandboxes
- If the remote can't be trusted, it can own your local machine.
- Another commenter clarified that the agent here is VSCode's SSH agent, not an LLM agent.
Size and alternatives reported
- One user reported .vscode-server at 6.0G.
- Others switched to Zed's SSH remote or ran code serve-web over Tailscale without SSH.

How to Apply

Check .vscode-server on your servers
- Run du -h -d 0 ~/.vscode-server on the remote to see its size.
- Also check ps for lingering node processes.
Set a Remote-SSH policy for production
- Ban VSCode Remote-SSH on production or limit which accounts can use it.
- Write separate dev and prod rules in the team wiki.
Treat the agent sandbox as a trust boundary
- Assume a compromised remote can attack your local machine when connecting with VSCode.
- Keep sensitive credentials off the laptop or connect from a separate environment.

Try It

copy & run

# Paste into a terminal on the remote server over SSH (check for VSCode Remote-SSH leftovers)

du -h -d 0 ~/.vscode-server

ps aux | grep -i '[.]vscode-server'

# Next: reflect the results in your team's access policy

Terminology

TrampAn Emacs tool for editing remote files over SSH as if local. It only borrows shell commands from the remote.

PTYA pseudo-terminal that lets a program run a shell as if it were a terminal. Think of it as the door to a remote shell window.

StagerA small bootstrap script that downloads and installs the real payload. Like the first knife that opens the package.

Port forwardingLinking a remote port to a local port through an SSH tunnel. It's like opening a private passage to the server.