Fly.io Deep Dive: VSCode's SSH Agent Is More Invasive Than It Looks

Fly.io engineer Thomas Ptacek published a detailed look at how VSCode edits files on remote machines over SSH, and the design he describes is far more invasive than the older tool it resembles. The post, "VSCode's SSH Agent Is Bananas", appeared on the Fly blog on 7 February 2025 and has circulated widely among developers who work on remote hosts.

Why Fly.io looked into it

Fly.io wants its platform to fit into the same flow VSCode uses for remote editing, because most developers now work in VSCode, including forks that generate code with LLMs. LLM-written code becomes far more useful when you close the loop between the model and the execution environment: the model writes code, an agent scaffolding runs it, the errors go back to the model, and the process repeats. That loop is exactly what you do not want on your own laptop, Ptacek argues, because LLMs have boundary issues and will happily iterate on your system configuration as well as the project you happen to be working in. A clean-slate Linux instance that starts in seconds is the safer place for it.

Tramp and the VSCode agent

Emacs' Tramp is the "spiritual forebearer" of remote editing. Point it at any interactive environment, usually an SSH session, where it can run Bourne shell commands, and it extends Emacs to that machine using what is already on the remote host. VSCode has a comparable feature. You might expect a simplified Tramp with TypeScript instead of Elisp. Instead, Ptacek writes, VSCode "mounts a full-scale invasion": a Bash snippet stager downloads an agent onto the remote host, including a binary installation of Node. The agent runs over port-forwarded SSH and opens a WebSocket connection back to the running VSCode front-end.

What the agent can do

The protocol behind that connection can wander around the filesystem, edit arbitrary files, launch its own shell PTY processes and persist itself on the host. Ptacek notes that the security world has a name for tools that behave this way, but declines to say it outright. He only offers that the name is "murid in nature" — an unmistakable nod to the rodent family, and to the term for a remote access trojan.

The practical takeaway

Ptacek says he would be "a little nervous" about VSCode remote editing on development servers, and "apoplectic" about it happening during an incident on something in production. The post ends on a practical note: Fly.io found it did not need to understand any of this to get a custom connection to a Fly Machine working in VSCode. The finding did not block their work — they simply thought it was worth knowing.