Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Researchers find 'Embrace' embedded-browser flaws in five AI coding tools; Codex and VS Code unpatched

Original title: Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched

The Register · Securityby Jessica Lyons ()3 min read1
Read at theregister.com
Part of a story covered by 3 sourcesEmbedded-browser flaws hit five AI tools; Codex and VS Code unpatchedMerged summary & timeline
AI summary · zhipu/glm-5.3-deriskedSummaries by Vani AI

Flaws in Codex and VS Code remain unpatched; Cursor silently fixed code execution and GitHub fixed Copilot spoofing in 1.1.29.

Forever Security found that the embedded browsers in Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code grant web pages abilities normal browsers do not, enabling prompt injection, file theft and address-bar spoofing. Cursor silently patched its code-execution flaw on October 1; GitHub fixed Copilot spoofing in build 1.1.29 on October 13 without a report. Forever says the Codex and VS Code file-read flaws remain unpatched, and Anthropic accepted the Claude Desktop flaw only after a second report from Noma Security.

Unconfirmed: Forever Security says OpenAI, Microsoft and Anthropic did not respond; Binance—none here. OpenAI and Microsoft have not confirmed or commented on the reported flaws.

Key facts
  • Forever Security says flaws in OpenAI Codex and Microsoft VS Code remain unpatched.
  • Cursor silently patched its code-execution flaw on October 1 without an advisory.
  • GitHub fixed Copilot address-bar spoofing in build 1.1.29 on October 13.
  • Anthropic rejected then accepted the Claude Desktop file-read report after a second report.
  • Claude Desktop, Codex and VS Code allow arbitrary file reads; Cursor allows host command execution.
Security assessment · AI, from the articleNo known exploitation

Impact: arbitrary code execution on host, arbitrary file read, and address bar spoofing

ProductAffectedFixed in
OpenAI Codex——
Microsoft VS Code——
Anthropic Claude Desktop——
GitHub Copilot1.1.271.1.29
Anysphere Cursor—October 1, 2026 patch
What to do
  1. 1.Check Cursor installs are updated past the October 1 silent patch.
  2. 2.Beware of Copilot address-bar spoofing of login pages; verify URLs independently.
  3. 3.Treat local HTML files opened in these tools' embedded browsers as untrusted.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1059 Command and Scripting InterpreterT1555 Credentials from Password Stores
Tags
ai-coding-toolsprompt-injectionembedded-browsercursorvs-codecopilot
Vendors
AnysphereGitHubAnthropicOpenAIMicrosoft
Products
CursorVS Code
Organizations
Forever SecurityNoma Security
AI models
CodexClaude DesktopGitHub Copilot

From the original article

3 min read at theregister.com

Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI's Codex and Microsoft's VS Code remain unpatched, potentially putting developers who use affected configurations at risk.

The Register · Security

By Jessica Lyons · theregister.com

Read the full article at The Register · Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.