Serious cross-session security issues with the read tool on remote host

- Copilot Chat Extension Version: 1.0.81-0
- VS Code Version: 1.136.1
- OS Version: Windows 11 24H2
- Feature (e.g. agent/edit/ask mode): agent
- Selected model (e.g. GPT 4.1, Claude 3.7 Sonnet): The problem is independent of the model used
- Logs:

Steps to Reproduce:

1. Open first window and connect to my server via SSH
2. Open the second window and connect to an container on the server via SSH
3. In the second window, instruct the Agent to call read tools (such as read_file, list_dir, grep_search, file_search)
4. All results returned by the tool are about the host server in the first window
5. The agent actually read content that was completely unrelated to the current environment