VS Code Agent Host: remote control from the browser

Your VS Code Copilot, reachable over the Internet — from your personal phone, a tablet or a gaming PC. That is now possible, and CISOs are not ready.

Agent Host: sessions live outside the editor

On August 26, Microsoft introduced the Agent Host in VS Code. The concept fits in one sentence: AI agent sessions no longer live inside the editor window, they live in a separate process. The window becomes a mere client, just another tab.

Concretely, you start a Copilot or Claude session on a folder. You close the folder, even the window. The agent keeps working. You reopen later, the state is there. The same session can even be open from two windows at once, synchronized.

Driving VS Code from a plain browser

Where it gets interesting: you connect your local VS Code to a remote Agent Host (insiders.vscode.dev/agents), over SSH or a dev tunnel. From a plain browser, you watch progress, approve tool calls, cancel a job. Your machine executes, your browser steers.

The protocol, AHP (Agent Host Protocol), is open. Rust, TypeScript, Go, Kotlin and Swift clients are already published. In other words: anyone can build their own agent-control client.

I find this indispensable for agentic coding. I run Claude Code remotely through Hermes/Telegram. This is exactly the 2026 dev workflow.

Why CISOs are behind

This is precisely where I think CISOs are completely outpaced. Let's recap what just became possible by default: an autonomous process that reads and modifies code, runs commands, on the dev's machine, controllable from a web browser, through a tunnel, over an open protocol any app can implement.

Every CISO spent years locking down remote access to workstations: VPN, Zero Trust, MFA, bastions, PAM for admin access. Now the remote entry point to the dev machine sits in a browser tab, behind a Copilot connection.

The questions to put on the table

The questions every CIO should raise this week: where do my teams' Agent Hosts run, local or remote? Who approves tool calls when the agent works autonomously overnight? What stops a dev tunnel from exposing an Agent Host behind a weak token?

The AI/agentic ecosystem moves at the pace of Copilot, Claude Code and Codex releases. Governance — where it exists — moves at a snail's pace. The gap will keep widening.

CISOs who spent months framing ChatGPT usage will have to absorb this. The difference is that this time it is immediately concrete: it already runs on their devs' machines.