Security researchers say the web browsers built into five widely used AI coding tools could be abused to run commands, steal files or disguise phishing pages, and that flaws in OpenAI's Codex and Microsoft's VS Code remain unfixed, The Register reported Thursday. The findings put developer workstations, which often hold source code, credentials and cloud keys, directly in the path of hostile web content.
What Happened
AI security startup Forever Security published research Thursday on a class of flaws it calls "Embrace," short for embedded browser. Forever researcher Gal Weizman wrote that each tool "enriched its embedded browser beyond what a normal browser allows."
The affected tools are Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code and Codex. According to the researchers:
- In Cursor, a web page could slip hidden instructions to the coding agent, a technique known as prompt injection, which could lead to commands running on the developer's machine.
- In GitHub Copilot, a page could make the address bar show a false address, such as a GitHub sign-in page, over a phishing site.
- In Claude Desktop, VS Code and Codex, a local web page opened in the built-in browser could read files anywhere on the computer, not only in the project folder.
How the Vendors Responded
Cursor was notified Sept. 10 and quietly fixed its flaw Oct. 1 without publishing a security advisory, The Register reported. Cursor did not respond to the researchers or the outlet. GitHub fixed the Copilot issue on its own, in build 1.1.29, before Forever reported it.
Forever told Anthropic about the Claude Desktop flaw July 23. Anthropic rejected the report as invalid, citing a "workspace trust" security boundary. Weizman said Anthropic accepted the same flaw as valid when Noma Security reported it a day later. Anthropic did not answer The Register's questions, and the researchers have not confirmed a fix.
OpenAI was told about the Codex flaw July 27 and did not respond to the researchers. An OpenAI spokesperson told The Register the company is aware of the issue and working to address it. Microsoft, notified Sept. 10, called the VS Code report invalid on the same workspace trust grounds, and the researchers say the flaw remains unpatched. Microsoft did not respond to The Register. No CVE numbers, the public tracking identifiers for security flaws, have been listed.
Why It Matters
AI coding tools put web content, an agent that can run commands and the local disk in one place. A file-read flaw that a vendor declines to treat as a vulnerability stays open until customers act, and developer laptops can hold the keys to production systems.
Security teams can inventory which AI coding tools are in use, require approval before agents run commands, and treat unfamiliar projects as untrusted. The Primary Wire reported Oct. 25, citing BleepingComputer, on a similar case where planted files could hijack coding agents.
What to Watch
- When OpenAI ships a Codex fix.
- Whether Microsoft revisits its VS Code position.
- Whether Anthropic confirms a Claude Desktop fix, and whether CVEs are assigned.
