{"slug": "researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws", "title": "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched", "summary": "Forever Security researchers found vulnerabilities in five AI developer tools — Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code, and OpenAI's Codex — that could allow code execution, file theft, or address bar spoofing, with the Codex and VS Code flaws still unpatched, The Register reported. Forever researcher Gal Weizman wrote that each tool \"enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model,\" a class Forever dubbed \"Embrace\" (EMbedded BRowser). Cursor silently patched its arbitrary-code-execution flaw on October 1 after a September 10 disclosure, and GitHub independently fixed Copilot's address-bar spoofing in build 1.1.29 on October 13 without a report from Forever.", "body_md": "# Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched\n\n[The Register](https://www.theregister.com)\n\nEmbedded browsers are at the heart of the problem\n\nMultiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in [OpenAI](https://www.machinebrief.com/glossary/openai)'s Codex and Microsoft's VS Code remain unpatched, potentially putting developers who use affected configurations at risk.\n\nAI security startup Forever Security discovered vulnerabilities in Cursor, GitHub [Copilot](https://www.machinebrief.com/compare/github-copilot-vs-cursor), [Anthropic](https://www.machinebrief.com/glossary/anthropic)'s [Claude](https://www.machinebrief.com/glossary/claude) Desktop, VS Code, and Codex, and disclosed four of the flaws to the affected vendors. GitHub independently fixed the Copilot vulnerability without receiving a report from Forever Security. All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers.\n\nEach tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday [report](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical).\n\nForever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot.\n\nHere’s what each of these looks like, starting with Cursor.\n\n### Cursor: arbitrary code execution\n\nTypical web pages can’t run commands on the host computer because a web page’s JavaScript cannot talk to local apps.\n\nCursor’s integrated browser, however, allows a page to call the agent’s composer. The agent reads this as instructions and follows them, but the instructions remain hidden from human users. This opens the coding agent up to prompt injection attacks that could allow an attacker to execute commands on the host machine.\n\nThe researchers disclosed the vulnerability to Cursor on September 10, and the vendor silently patched the flaw on October 1. According to Forever, Cursor did not publish a security advisory about the issue or respond to the researchers' disclosure.\n\nCursor also did not reply to The Register’s request for comment.\n\n### GitHub Copilot: address bar spoofing\n\nUnder normal browser operations, a webpage cannot change the content of the address bar.\n\n“Copilot’s browser preview works differently,” Weizman wrote. “Some pages change their address without loading a new page, and the app cannot always see that. So Copilot let the page tell the app its own address.”\n\nThe app checked only whether the text looked like a web address, starting with http, https or file, but it didn’t check where the tab really pointed to. This can be abused to trick the embedded browser into displaying a spoofed URL - such as github.com/login - in the address bar, while loading a fraudulent website - like a phishing page - underneath.\n\nThe researchers found the address-bar spoofing flaw in GitHub Copilot 1.1.27 on September 26. GitHub independently fixed the flaw in a later Copilot build (1.1.29) on October 13 without receiving a vulnerability report from Forever.\n\nWe reached out to GitHub and did not receive a response.\n\n### Claude Desktop, Codex, and VS Code: arbitrary file read\n\nAll three of these vendors’ coding assistants allow local HTML files opened in the built-in browser to escape its boundaries and access other files.\n\nBoth Claude Desktop and VS Code allow local pages access to their respective project folders, but the researchers found that these restrictions did not apply to web workers – a browser feature that allows JavaScript to run in a background thread, separate from the page's main thread.\n\nThis means a local page can start a worker, and the worker can bypass restrictions to reach any file on the machine.\n\nCodex, however, didn’t have this same restriction, meaning a local page could read any file directly without a worker.\n\nWeizman said his team disclosed the issue to Anthropic on July 23, and the AI vendor declined the Claude Desktop bug report as invalid for a “workspace trust” gated security boundary. A day later, however, Noma Security reported the same flaw, according to Weizman, and Anthropic accepted the report as valid.\n\nAnthropic did not respond to The Register’s questions about either bug report or Forever’s timeline of events.\n\nForever disclosed the Codex bug to OpenAI on July 27 and didn’t get a response. The security team says it’s still unpatched. OpenAI did not respond to our inquiries, including if it planned to fix the flaw.\n\nOn September 10, Forever disclosed the VS Code vulnerability to Microsoft and says the vendor also labeled it as an invalid workspace trust gated security boundary issue. The researchers claim it remains unpatched. Microsoft did not respond to our request for comment.®\n\nGet AI news in your inbox\n\nDaily digest of what matters in AI.", "url": "https://wpnews.pro/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws", "canonical_source": "https://www.machinebrief.com/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-an-3lha", "published_at": "2026-10-29 23:12:26+00:00", "updated_at": "2026-10-30 01:18:36.108831+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools", "ai-agents", "artificial-intelligence"], "entities": ["Forever Security", "Gal Weizman", "Cursor", "GitHub Copilot", "Anthropic", "Claude Desktop", "Microsoft", "VS Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws", "markdown": "https://wpnews.pro/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws.md", "text": "https://wpnews.pro/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws.txt", "jsonld": "https://wpnews.pro/news/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws.jsonld"}}