Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Embedded-browser flaws hit five AI tools; Codex and VS Code unpatched

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 30: Cyber Security News adds Copilot 1.1.27 confirmation, a Cursor sandbox retry, a Codex macOS DS_Store filename test, and that OpenAI did not respond.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Forever Security says Codex and VS Code file-read flaws remain unpatched after Cursor and Copilot fixes.

Forever Security reported that embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop break isolation, enabling prompt injection, local file reads and address-bar spoofing. A project HTML page opened through an assistant link can read SSH keys, tokens and .env files in Codex, VS Code and Claude Desktop. Cursor could run an agent command after one keypress; Copilot’s preview could spoof a github.com/login address. Cursor patched on October 1 and GitHub fixed Copilot in 1.1.29 on October 13. As of October 29, Codex and VS Code remained unpatched; Help Net Security says Anthropic declined the Claude Desktop report, while The Register says Anthropic later accepted it after a Noma Security report.

Key facts
  • Copilot spoofing was confirmed in 1.1.27 and fixed in 1.1.29 on October 13.
  • Cursor patched on October 1 after a September 10 report, without an advisory.
  • Web workers bypass Claude Desktop and VS Code folder checks.
  • Microsoft rejected the VS Code report, citing Workspace Trust.
  • Cyber Security News says OpenAI did not respond.
  • Cursor’s exploit success depended on the model and could retry outside the sandbox.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 10, 2026Researchers reported the Cursor flaw. · Help Net Security
  2. Oct 1, 2026Cursor patched its code-execution flaw. · The Register
  3. Oct 13, 2026GitHub fixed Copilot spoofing in 1.1.29. · Help Net Security
  4. Oct 29, 2026Forever Security said Codex and VS Code were still unpatched. · Help Net Security

What each outlet adds

beyond the shared facts
  • Help Net SecuritySeptember 10 Cursor report date and web-worker folder-check bypass.
  • The RegisterSilent Cursor patch; Anthropic accepted after Noma’s second report.
  • Cyber Security NewsCopilot 1.1.27, sandbox retry, DS_Store test, no OpenAI response.
Vendors
CursorGitHubMicrosoftOpenAIAnthropicAnysphere
Products
GitHub CopilotCodexVS CodeClaude DesktopCursor
Organizations
Forever SecurityNoma Security
AI models
CodexClaude DesktopGitHub Copilot

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Help Net SecurityFirst report

    Embedded browsers in five AI coding tools can leak files or run code

    As of October 29, Codex and VS Code still let one local HTML click read SSH keys, tokens and .env files.

  2. · 20h ago The Register · Security

    Researchers find 'Embrace' embedded-browser flaws in five AI coding tools; Codex and VS Code unpatched

    Flaws in Codex and VS Code remain unpatched; Cursor silently fixed code execution and GitHub fixed Copilot spoofing in 1.1.29.

  3. · 8h ago Cyber Security News

    Embedded browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop flawed

    Forever Security’s EMBRACE findings show prompt injection, address spoofing, and local file reads; Codex and VS Code were still unpatched.