---
title: "VSCode’s SSH Agent Is Bananas"
description: "VSCode’s remote-editing flow over SSH is examined as a concern for running LLM-driven agent workflows on remote machines. The motivation is to keep iterative code generation and execution away from a development laptop, ideally on a clean-slate Linux instance that starts instantly and cannot damage the host. Unlike Emacs Tramp, which operates through commands on the remote connection, VSCode uses a Bash snippet stager to download an agent, including a binary Node installation. That agent communicates over port-forwarded SSH through a WebSockets connection to the VSCode front end and can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself. The author says this raises concerns for development servers and especially production incident work, while noting a custom Fly Machine connection avoids needing this mechanism."
---

# VSCode’s SSH Agent Is Bananas

[Fly.io](https://yomu.fyi/company/fly-io) · Feb 7, 2025

**Type:** Explainer

## Summary

VSCode’s remote-editing flow over SSH is examined as a concern for running LLM-driven agent workflows on remote machines. The motivation is to keep iterative code generation and execution away from a development laptop, ideally on a clean-slate Linux instance that starts instantly and cannot damage the host. Unlike Emacs Tramp, which operates through commands on the remote connection, VSCode uses a Bash snippet stager to download an agent, including a binary Node installation. That agent communicates over port-forwarded SSH through a WebSockets connection to the VSCode front end and can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself. The author says this raises concerns for development servers and especially production incident work, while noting a custom Fly Machine connection avoids needing this mechanism.

## Context

The concern is that LLM-driven agent workflows can iterate on a development laptop’s system configuration as readily as on the project being edited. The desired alternative is an instantly starting, clean-slate Linux instance that cannot damage the host, while the remote-editing mechanism itself raises concerns for development servers and production incident work.

## Approach / What changed

The post compares VSCode’s SSH-based remote editing with Emacs Tramp, describing VSCode’s Bash snippet stager, downloaded agent, bundled Node binary, port-forwarded SSH, and WebSockets connection to the front end. It also notes that a custom connection to a Fly Machine can work without relying on this mechanism.

## Takeaways

- VSCode’s remote agent is staged by a Bash snippet and downloads an agent containing a binary installation of Node, rather than operating solely through commands already available on the remote connection.
- The agent’s WebSockets protocol, carried over port-forwarded SSH, can access the filesystem, edit arbitrary files, launch shell PTY processes, and persist itself.
- The author considers remote editing on development servers concerning and would be especially alarmed by its use during a production incident, but says custom Fly Machine connections do not require this flow.

**Tags:** [Security](https://yomu.fyi/topic/security), [SSH](https://yomu.fyi/topic/ssh), [WebSockets](https://yomu.fyi/topic/websockets)

- Source: [Fly.io](https://fly.io/blog/vscode-ssh-wtf)
- Source URL: https://fly.io/blog/vscode-ssh-wtf
- Ingested by Yomu: 2026-09-03T01:26:14.143Z

[Read original post](https://fly.io/blog/vscode-ssh-wtf)