VS Code update unexpectedly executes code-tunnel.exe tunnel kill, triggering endpoint security detections

Does this issue occur when all extensions are disabled?: Yes

* OS Version: Windows 11
Version: 1.134.0 (user setup)
Date: 2026-08-18T18:24:44Z
Electron: 42.8.1
ElectronBuildId: 14906494
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
@github/copilot: 1.0.81-0
@github/copilot-sdk: 1.0.11

## Steps to Reproduce:

1. Install Visual Studio Code on Windows.
2. Allow VS Code to automatically update to a newer version.
3. Monitor process execution during or immediately following the update.
4. Observe execution of the VS Code `code-tunnel.exe` component, located under the VS Code installation directory.
5. In my environment, the observed command line was:
`code-tunnel.exe tunnel kill`
6. The execution is detected by endpoint security/MDR tooling as potential SSH/lateral-movement activity.

## What happened?

Each time VS Code updates, execution of `code-tunnel.exe` appears to trigger a security detection in our endpoint security environment.

The detection identifies the activity as related to VS Code Remote Tunnels and maps it to MITRE ATT&CK T1021.004 (SSH). The security tooling therefore generates an alert that requires investigation.

I do not believe this is necessarily a bug in VS Code, and I am not claiming that the behavior is malicious. I am reporting it because the behavior appears to occur as part of the normal VS Code update process and can cause security products to generate potentially misleading security alerts.

## Expected behavior

If `code-tunnel.exe tunnel kill` is expected behavior during a VS Code update, it would be helpful to document this behavior and/or consider whether the execution can be performed in a way that is less likely to be interpreted by endpoint security products as an unexpected remote-access operation.

If this behavior is not expected during a normal update, this report may help identify why `code-tunnel.exe` is being invoked.

## Additional information

The security detection is specifically associated with:

`code-tunnel.exe tunnel kill`

The security product identifies the activity as:

* MITRE ATT&CK Tactic: TA0008 — Lateral Movement
* MITRE ATT&CK Technique: T1021.004 — SSH

The security alert is generated even though the VS Code installation/update itself is legitimate.

I am primarily submitting this as an awareness/compatibility concern so the VS Code team can confirm whether this behavior is expected and, if so, whether there is anything that can be done to prevent legitimate VS Code updates from unnecessarily generating security alerts.