VSCode spawning whoami.exe triggers security alerts
- Dominant language
- TypeScript
- Stars
- 193k
- Forks
- 42.4k
- PR merge metrics
- PR metrics pending
Description
This falls between a non-critical bug and a non-critical security issue.
VSCode is now spawning "whoami.exe" at every launch which, in sensitive environements, triggers EDR and CanaryTokens alerts.
It is triggered by this line, introduced by commit 63a0428 in the AHP plumbing:
https://github.com/microsoft/vscode/blob/70698c24b33320f227ea18231a48b1fdc3190f8b/src/vs/platform/agentHost/node/localAgentHostMetadata.ts#L342
Are there other viable options, not involving the creation of new processes ?
Does this issue occur when all extensions are disabled?: Yes
- VS Code Version: 1.133.0+
- OS Version: Windows 11 Pro
Steps to Reproduce:
1. Launch VSCode with AI Chat features enabled
Contributor guide
Assessment
This issue has not been assessed yet.