Embedded browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop flawed
Original title: Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers
Forever Security’s EMBRACE findings show prompt injection, address spoofing, and local file reads; Codex and VS Code were still unpatched.
Forever Security said on October 29 that embedded browsers in Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop trusted page content too far. Cursor let any loaded page inject agent instructions that could lead to an npm install and code execution; success depended on the model. Copilot’s preview could show a fake github.com/login address. Claude Desktop and VS Code failed to restrict web workers, and Codex local pages could read files such as SSH keys and tokens. Cursor patched on October 1 and Copilot 1.1.29 on October 13.
Unconfirmed: Anthropic accepted the Claude Desktop issue, but the report does not state whether it is patched.
- Copilot spoofing was confirmed in version 1.1.27 and fixed in 1.1.29.
- Cursor’s sandbox block could be followed by a retry outside the sandbox.
- A macOS Codex test used DS_Store metadata to find filenames.
- Microsoft rejected the VS Code report on Workspace Trust grounds.
- OpenAI did not respond; Anthropic’s patch status is not stated.
Impact: Code execution, local file theft, or spoofed login addresses
| Product | Affected | Fixed in |
|---|---|---|
| Cursor embedded browser | — | patched October 1 |
| GitHub Copilot | 1.1.27 | 1.1.29 |
| OpenAI Codex | — | — |
| Microsoft VS Code | — | — |
| Anthropic Claude Desktop | — | — |
- 1.Update GitHub Copilot to 1.1.29 or later.
- 2.Treat Codex and VS Code embedded-browser issues as unpatched at publication.
- Organizations
- Forever Security
From the original article
2 min read at cybersecuritynews.com
Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines. The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps. The […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.