Threat Actors Expand Abuse of Microsoft Visual Studio Code

Re:Threat Actors Expand Abuse of Microsoft Visual Studio Code by skybrian on Thursday January 22, 2026 @02:04PM (#46723709)

I'm moving all my development to a remote VM so I can use a coding assistant without worrying too much. I use VS Code's "Remote - SSH" plugin to connect.

I'm wondering if that helps. If I "trust" a remote directory, is there an exploit that can get to my laptop?

There's enough complicated machinery that I'm thinking the answer is likely yes, but perhaps this has been vetted.

[ Parent | on HN ]

Re:Threat Actors Expand Abuse of Microsoft Visual Studio Code by artbristol on Thursday January 22, 2026 @02:59PM (#46724421)

Unfortunately according to Microsoft themselves, the answer is yes https://marketplace.visualstudio.com/items?itemName=ms-vscod...

> A compromised remote could use the VS Code Remote connection to execute code on your local machine.

[ Parent | on HN ]

Re:Threat Actors Expand Abuse of Microsoft Visual Studio Code by skybrian on Thursday January 22, 2026 @06:50PM (#46726648)

Ah well. Since I'm mostly reading code in the VM, I should come up with a better file browser.

[ Parent | on HN ]