2/22/2026 at 6:55:18 PM
Is Microsoft ever going to implement proper VS Code plugin sandboxing? There are so many good extensions I would like to use, but I hate the security implications of loading yet more unvetted code for a nice-to-have.Then again, I see that the top buzz in the industry is about Claws and letting LLMs run loose with only a handshake agreement to be safe, and I already know the answer.
by 3eb7988a1663
2/22/2026 at 10:33:33 PM
And it's only getting worse with the waves of vibe-coders.I actually wrote about this recently after poking around a popular extension that Antigravity users were installing. It's wild what people are doing with your credentials, and you'd have no idea! https://opista.com/posts/blind-trust-in-vs-code-extensions
by StrangeSound
2/22/2026 at 10:48:39 PM
I got in an argument with someone the other day that said their vibe coded app was more secure than something hand written because the ai “knows all exploits”.We’re cooked.
by dawnerd
2/22/2026 at 10:57:46 PM
That's why any repo with a README ridden with emojis (and other telltale signs) is just an instant nope nowadays.(One of the only good things about GH is, that if you block some account, it will tell you if that account contributed to some repo at the top. Makes it very easy to filter out slopcode.)
by christoph-heiss
2/23/2026 at 1:09:40 PM
This is in part why I've been developing inside a VM for the last 2 years. Interestingly, VS Code has nice support for installing and running extensions on the remote. Only themes live on the host.by disintegrator
2/22/2026 at 7:19:49 PM
The only real answer is something like web assembly and that would be a major breaking change for them.This is why allot run dev containers but agreed this really should be top priority but instead is probably in the "maybe if we have a major security incident" bucket of concerns as these things often are
by MantisShrimp90
2/23/2026 at 7:46:06 AM
This is already supported for a while and is the way to have those Rust and C++ processes run in the Web IDE version on Github and Azure DevOps.by pjmlp
2/23/2026 at 3:46:01 AM
which other text editors implement sandboxing?by socalgal2
2/23/2026 at 4:43:53 AM
emacs can but for some reason by default only does it with themesby bandrami
2/23/2026 at 7:47:33 AM
Not really, because it only works for Elisp code, and nothing else that might be called as external process.by pjmlp
2/23/2026 at 7:57:37 AM
Oh I see what you're saying; right, if elisp launches a process it's just a normal process (unless the elisp itself containerizes it when it launches it)by bandrami
2/22/2026 at 7:03:39 PM
There's no malware in it currently, but I understand your concerns - I could be lying, go rogue later, or just get my access stolen.One option is to vet a version yourself and disable auto-update, but that's not really feasible to spend time on for most people.
by frehu
2/22/2026 at 7:10:49 PM
Sorry, no sleight intended against you, just a general concern as more and more cool utilities keep getting built into the platform.by 3eb7988a1663
2/22/2026 at 7:20:52 PM
No offense taken, you actually made me reconsider trying out random extensions that sound like mine to make sure i'm not reinventing the wheelby frehu
2/22/2026 at 7:26:06 PM
Doesn't seem like it. It will be stuck in a security theater situation, just like Chrome extensions. Not an upgrade from the old highly powerful firefox extensions or those of the Atom text editor.by benatkin
2/22/2026 at 7:47:30 PM
[dead]by frehu