Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Embedded browsers in five AI coding tools can leak files or run code

Original title: Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop

Help Net Securityby Mirko Zorz ()3 min read2 · 1 read
Read at helpnetsecurity.com
Part of a story covered by 3 sourcesEmbedded-browser flaws hit five AI tools; Codex and VS Code unpatchedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

As of October 29, Codex and VS Code still let one local HTML click read SSH keys, tokens and .env files.

Forever Security says the embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop each broke a browser isolation rule. A project HTML file, opened via a link the assistant draws, can read the disk in Codex, VS Code and Claude Desktop; Cursor could run an agent command after one keypress, and Copilot could spoof the address bar. Cursor patched on October 1 and Copilot in 1.1.29 on October 13. Codex and VS Code remained unfixed as of October 29. Anthropic and Microsoft declined reports, citing Workspace Trust.

Unconfirmed: The Cursor command-execution path depends on the model and did not work every time; OpenAI had not replied by publication.

Key facts
  • Codex and VS Code had no fix as of October 29.
  • GitHub fixed Copilot in version 1.1.29 on October 13.
  • Cursor patched on October 1 after a September 10 report.
  • Web workers bypass Claude Desktop and VS Code folder checks.
  • Anthropic and Microsoft declined reports citing Workspace Trust.
Security assessment · AI, from the articlePublic proof of concept

Impact: Disk file reads or code run with developer privileges

ProductAffectedFixed in
OpenAI Codex——
Microsoft VS Code——
Anthropic Claude Desktop——
Cursor—patched October 1
GitHub Copilot—1.1.29
What to do
  1. 1.Review trusted projects in Codex and VS Code and inspect their HTML files.
  2. 2.Update Cursor and GitHub Copilot to the patched releases.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1204.001 Malicious LinkT1005 Data from Local SystemT1059 Command and Scripting Interpreter
Tags
vscodecursorgithub-copilotclaude-desktopcodexembedded-browser
Vendors
MicrosoftGitHubOpenAIAnthropicCursor
Products
VS CodeGitHub CopilotCodexClaude Desktop
Organizations
Forever SecurityNoma Security

From the original article

3 min read at helpnetsecurity.com

Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.

Help Net Security

By Mirko Zorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.