Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk. Two of those holes are still … More
The post Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop appeared first on Help Net Security.
source & further reading
helpnetsecurity.com — original article
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
GitHub’s npm package firewall can block brand-new versions before they install
ControlUp’s Pulse AI Resolve diagnoses and fixes IT issues within admin-defined controls