Visual Studio Code 1.141 turns your editor into an agent control center, then 1.141.1 seals the doors

The Visual Studio Code 1.141.1 security update closed two path traversal vulnerabilities, including a "Critical" 9.6 RCE that needs user interaction to exploit. 

Visual Studio Code 1.141 shipped to the Stable channel on October 7, 2026, and the release notes read less like an editor update and more like a thesis on the future of coding. Microsoft is consolidating everything around AI agents: a unified Copilot harness, sessions you can drag into grids, and the ability to continue work across apps without a reload. The text editor is becoming a control plane.

Exactly six days later, on October 13, Microsoft issued Update 1.141.1. It's a security patch, and it's not a small one. It closes two vulnerabilities, including a "Critical" 9.6 remote code execution flaw. That gap between the two dates isn't a coincidence. Bigger agent capabilities mean a bigger surface to worry about.

An editor for agents, not just code

The single most important change in 1.141 is the Copilot harness, now running in a dedicated agent host process built on the Agent Host Protocol (AHP). The point is that the same session can be connected to from multiple VS Code windows at once. It lines up with the standalone GitHub Copilot app and the Copilot CLI, both also powered by the Copilot SDK.

For those running with experiments enabled, this Copilot harness is quietly becoming the default.

Microsoft's headline act is session management. The Agents window now has a two-dimensional grid where you can drag conversations into horizontal or vertical splits and resize the panes. It sounds fiddly until you're juggling three related threads and wish you could see them all at once.

Then there's continuity. Sessions started in the Copilot CLI or the GitHub Copilot app are now picked up automatically as external sessions the moment the first request goes out, even if the Agents window is already open. A similar handoff lets you grab a Codex chat from the ChatGPT app or Codex CLI and finish it in VS Code, history intact, bouncing back and forth between the two.

There's also a worktree cleanup tool, since abandoned agent sessions leave behind isolated Git worktrees that slowly eat your disk. "Chat: Open Worktree Cleanup" shows you how much space inactive sessions are hogging, lets you filter by inactivity and size, and deletes what you don't need. You can set it to run automatically.

For what it's worth, there's still a chat pet. Type /vscode-pet to meet Blobby.

The 1.141.1 patch

Microsoft framed 1.141 around six features. The 1.141.1 patch, by contrast, came through a single squashed fix that hardened several security boundaries at once. Path traversal, sandbox configuration, workspace trust, terminal notifications, edit approvals. Forty-two files changed.

Two bugs made it into an actual advisory.

CVE-2026-102238 is the headline. It's a path traversal (CWE-22) that lets an attacker run arbitrary code on your machine, but only if you open a workspace, folder, repo, or project file that's been crafted to point back outside its allowed directory. It's scored 9.6. That number will look like a monster in any headline.

Here's the nuance. The vector includes UI:R, meaning it needs user interaction. Nobody's going to exploit this remotely and autonomously, someone has to actually open attacker-supplied content. It's social engineering, plain and simple. No public proof-of-concept has surfaced, and the CVE isn't on CISA's Known Exploited Vulnerabilities list, so there's no evidence anyone is running this at scale. The "network" part of the score just describes how the malicious content arrives, not a live remote-service exploit.

Still worth patching. It affects every VS Code version from 1.0.0 through 1.141.0.

CVE-2026-102229 is the quieter one. Remote webview resource paths weren't normalized before being checked against a webview's allowed roots, so a specially crafted request could read files outside those directories, again, while connected to a remote workspace over SSH or a dev container. The fix normalizes those paths against the remote OS's rules and denies anything it can't figure out.

Microsoft even used the patch to clean up stale MCP sandbox settings files, which previously lacked reliable lifecycle management. Good hygiene, buried in the fine print where it belongs.

Sandboxing and the rest

If you want the feature that will matter most in a year, it's not in the patch. It's in 1.141: cross-platform sandboxing for the Copilot Agent Host. Controlled by chat.agent.sandbox.enabled, it limits what agent operations can touch on files and the network, which shrinks the blast radius of a model mistake or a prompt-injection attack. It runs on Windows, macOS, and Linux, and on Windows it's enforced at the OS or kernel level for terminal commands and child processes.

Enterprises can push it fleet-wide through managed settings, requiring the sandbox and killing the bypass option. That's a meaningful shift. Microsoft is treating agent trust like a first-class concern rather than an afterthought.

Not cheap, by the way, several of these features lean on Copilot. And there's a small cost to the direction here: the more your editor talks to remote servers, MCP instances, and autonomous tool calls, the more you're trusting a lot of machinery you didn't have to trust a year ago. VS Code 1.141 is the clearest sign yet that Microsoft wants that trade to feel worth it.

The quieter wins are the ones everyday users will actually notice. Spreading block paste now distributes copied rows across successive lines when editor.multiCursorPaste is set to spread, which makes columnar or aligned text far less painful. Signing into multiple GitHub Enterprise instances finally works too, through the new multi-value github-enterprise.uris setting, with the old singular uri now deprecated and its credentials migrated automatically on first launch.

What to do

Upgrade to 1.141.1 or later on every managed device. If you haven't touched your sandbox settings, take a look at chat.agent.sandbox.enabled before you hand your agents wide access to files and the network. And if you're still using the old github-enterprise.uri setting, it's time to migrate to the list-based version.

Head here to download the new release.