microsoft / microsoft/vscode

VSCode spawning whoami.exe triggers security alerts

Open
#332,710 2 comments 1 reaction 1 assignee Claimed by @anthonykim1 View on GitHub
Dominant language
TypeScript
Stars
193k
Forks
42.4k
PR merge metrics
PR metrics pending

Description

This falls between a non-critical bug and a non-critical security issue.

VSCode is now spawning "whoami.exe" at every launch which, in sensitive environements, triggers EDR and CanaryTokens alerts.

It is triggered by this line, introduced by commit 63a0428 in the AHP plumbing:

https://github.com/microsoft/vscode/blob/70698c24b33320f227ea18231a48b1fdc3190f8b/src/vs/platform/agentHost/node/localAgentHostMetadata.ts#L342

Are there other viable options, not involving the creation of new processes ?

Does this issue occur when all extensions are disabled?: Yes

- VS Code Version: 1.133.0+
- OS Version: Windows 11 Pro

Steps to Reproduce:

1. Launch VSCode with AI Chat features enabled

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.