VS Code Puts the Agent in Its Own Process, and the Boundary Argument Is Over
On July 16, Visual Studio Code 1.129 shipped with a new agent host: a dedicated OS process, separate from the editor, that runs every agent harness — Copilot, Claude Code, Codex, or a custom one — under a new Agent Host Protocol (AHP). Enable chat.agentHost.enabled, pick a harness, and the agent runs out of the editor's address space. A crashed agent no longer takes down VS Code. The same agent session can be attached from multiple windows at once. And any AHP-speaking harness plugs into the same runtime.
The Help Net Security writeup frames it as an architecture change; Visual Studio Magazine covers the new Agents window editor that comes with it. Microsoft's own release notes describe it in stability terms — resilience, multi-window, session management. Read alongside three other launches from the same eight-day window, it is something bigger: the moment the largest developer IDE on the planet made "the AI agent is a separate process at the OS boundary" its default answer to a question the industry has spent the year arguing about.
Four launches in eight days
Nothing about the argument is new. What changed in the eight days from July 13 to July 20 is who is now shipping the answer.
- Cloudflare Precursor (Jul 13). A client-side, session-long behavioral validator inside Enterprise Bot Management. Continuously runs in the browser, capturing signals across a session — cursor, scroll, typing, clipboard, page-visibility — and evaluating them against the user journey rather than the individual HTTP request. Cloudflare's own framing: an automated agent "cannot reset its behavioral signature by refreshing a page."
- Lineation.ai (Jul 15). A Zero-Trust runtime control plane for autonomous agents. Non-Human Identity per agent, an inline LLM/MCP gateway, continuous policy-as-code at every tool call, an immutable reasoning audit trail.
- Google Agentic Defense (Jul 17). Google's first integrated post-Wiz security offering. Detection agents that "continuously analyze cloud environments, identify anomalous behavior, and respond in real time" — Google's language, mapping almost word-for-word onto everything else in this list.
- VS Code Agent Host (Jul 16). The agent leaves the editor process. Every tool call the agent makes now crosses a real OS boundary out of a runtime that a security tool can attach to.
Four different companies, four different scopes — an edge CDN, a runtime control plane, a hyperscaler security suite, and an IDE. The overlap in the shape of the answer is the point.
Why the shape converges
For most of the year the argument about where AI agent security has to live has been a variation of the same question. If a model cannot reliably tell instructions from data — MIT's Role Confusion paper made the mechanistic case in June — and if the taxonomy of ways to fool it is 200-and-counting, then the durable guarantee cannot be inside the model. It has to be at some layer the model does not control.
The candidate layers are limited. It has to be something an adversary who owns the model's context cannot rewrite. In practice that leaves the OS process, the network socket, and the syscall — the same places every other kind of software security control lives. What these four launches share is that each one is a bet on one of those layers.
Cloudflare bets on the network session at the edge. Lineation bets on the MCP call and the tool invocation. Google bets on the cloud workload boundary. Microsoft bets on the OS process inside the developer's own machine.
Microsoft's is the most consequential of the four for one reason: Visual Studio Code is where the coding agent lives for tens of millions of developers. When the default IDE for that population puts the agent in its own process and defines a protocol other harnesses can adopt, the process boundary stops being an argument and starts being an assumption. Everything that watches the agent — telemetry, EDR, a runtime behavioral watchdog — now has a stable place to attach.
What is left to argue about
Six months ago a post arguing that runtime behavioral monitoring belongs outside the model was still a pitch. This week it is closer to consensus. The question is no longer whether the process/network boundary is the right place to defend an AI agent. Four separate vendors this week say it is. The question is what a defender does with that boundary — how fast it sees a bad action, how it distinguishes a real user gesture from a scripted one (see ClaudeBleed Reopened from two days ago for the version of that problem inside a browser process), what it refuses, and how it explains that refusal to the human on the other end.
Those are better questions than the one about whether the boundary matters. Microsoft just retired that one.
Sources
- Microsoft — Visual Studio Code 1.129 release notes
- Help Net Security — VS Code agent host runs Copilot, Claude, and Codex in a dedicated process
- Visual Studio Magazine — VS Code 1.129 Introduces Agent Host and Experimental Agents Window Editor
- Cloudflare — Introducing Precursor
- Google Cloud — Redefining security for the AI era with Google Cloud and Wiz
- Help Net Security — Lineation.ai launches first Zero Trust runtime security control plane for autonomous AI agents
- CrowdStrike — CrowdStrike Uncovers New Prompt Injection Techniques
- Ye, Cui, Hadfield-Menell (MIT) — Prompt Injection as Role Confusion
- Manifold Security — ClaudeBleed Reopened
SPR{K3 is a security research operation that pairs offensive vulnerability research with runtime behavioral defense. Defend is our runtime agent. To talk about a deployment, reach us at support@sprk3.com.