Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI's Codex and Microsoft's VS Code remain unpatched, potentially putting developers who use affected configurations at risk. AI security startup Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and Codex, and disclosed four of the flaws to the affected vendors. GitHub independently fixed the Copilot vulnerability without receiving a report from Forever Security. All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers. Each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday report. Forever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot. Here’s what each of these looks like, starting with Cursor. Typical web pages can’t run commands on the host computer because a web page’s JavaScript cannot talk to local apps. Cursor’s integrated browser, however, allows a page to ...
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
Affected Software
Frequently Asked Questions
Which tools were affected, and which vulnerabilities remain unpatched?
The affected tools are Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code, and OpenAI Codex. The article says flaws in Codex and VS Code remain unpatched, while GitHub independently fixed the Copilot issue.
What could an attacker do by exploiting these flaws?
The vulnerabilities could allow code execution on a host machine, reading and theft of files, or browser address-bar spoofing. The reported impact varies by tool and configuration.
What common weakness did the researchers identify?
All five tools used embedded browsers with capabilities beyond those of conventional browsers. Researchers said those added capabilities undermined browser threat-model boundaries involving agent input, the displayed address of a tab, and access to the host.
Were all of the issues reported to vendors by the researchers?
Forever Security said it disclosed four flaws to the affected vendors. GitHub fixed the Copilot vulnerability independently, without receiving a report from Forever Security.