Researchers at security firm Forever Security have discovered vulnerabilities in five popular AI developer tools that could let attackers execute code on host machines, steal files, or spoof website addresses. The flaws, which affect Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex, stem from a common class of weakness the company calls 'Embrace', over-empowered embedded browsers. While Cursor and GitHub Copilot have been patched, flaws in VS Code and Codex remain unpatched, according to the researchers.
The five tools each include an embedded browser, and the researchers found those browsers were granted capabilities beyond those of a conventional browser. In a Thursday report, Forever Security researcher Gal Weizman wrote that each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model – as agent input, as the authority on a tab's own address, or as reach onto the host.”
In Cursor, the integrated browser allowed a malicious web page to call the coding agent's composer, opening it to prompt injection attacks that could allow an attacker to execute commands on the host machine. Forever disclosed the vulnerability to Cursor on September 10, and the vendor silently patched it on October 1 without publishing a security advisory or responding to the researchers' disclosure. In GitHub Copilot, a flaw in the browser preview could be abused to display a spoofed URL in the address bar while loading a fraudulent website underneath. GitHub independently fixed that issue in build 1.1.29 on October 13 without receiving a vulnerability report from Forever.
The remaining three tools, Claude Desktop, Codex and VS Code, each contained flaws enabling arbitrary file reads. In all three, local HTML files opened in the integrated browser could bypass restrictions and access other files on the machine. In Codex, a local page could read any file directly without a web worker. Forever disclosed the Claude Desktop bug to Anthropic on July 23, but the AI vendor declined it as a 'workspace trust' boundary issue. According to Weizman, a day later security firm Noma reported the same flaw, and Anthropic accepted it as valid. The researchers disclosed the Codex bug to OpenAI on July 27 and say it remains unpatched. The researchers say Microsoft labeled the VS Code vulnerability, disclosed on September 10, as invalid for a workspace trust gated security boundary issue, and that it remains unpatched.
OpenAI, Microsoft and Anthropic did not respond to The Register's requests for comment. The researchers said the vulnerabilities in OpenAI's Codex and Microsoft's VS Code could put developers using affected configurations at risk.
Analysis
Why This Matters
- The 'Embrace' class of vulnerability highlights a new attack surface in AI-powered development tools that could be exploited to compromise developer machines.
- Unpatched flaws in OpenAI's Codex and Microsoft's VS Code affect a large user base, potentially enabling supply chain attacks.
- The mixed vendor responses underscore inconsistency in handling security disclosures for AI tools.
Background
AI coding assistants have become essential for developers, using large language models to generate code. Many integrate with code editors and provide embedded browsers for previewing documentation, web pages or code output. Giving these browsers capabilities beyond standard browser sandboxing creates a security risk if not carefully managed.
Key Perspectives
- Forever Security: identifies the root cause as enriched embedded browsers that break the traditional security model.
- Cursor: silently patched the vulnerability but did not issue a security advisory or respond to the researchers.
- GitHub: fixed the Copilot flaw independently without receiving a report from Forever.
- Anthropic: initially rejected the Claude Desktop bug report but accepted it after a second firm reported the same issue.
- OpenAI: did not respond to the disclosure; the Codex bug remains unpatched.
- Microsoft: labeled the VS Code bug as invalid and the flaw remains unpatched.
What to Watch
- Whether Microsoft and OpenAI address the remaining vulnerabilities or if they face external disclosure.
- Potential for similar 'Embrace' flaws to be found in other developer tools with embedded browsers.
- Industry adoption of more rigorous security reviews for AI assistants.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedResearchers found “Embrace” flaws in five AI developer tools.www.theregister.com - Articles: “Forever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser”
- SupportedThe OpenAI Codex and Microsoft VS Code flaws remain unpatched.www.theregister.com - Articles: “Researchers say flaws in OpenAI’s Codex and Microsoft’s VS Code remain unpatched”
- SupportedThe embedded-browser flaws could allow code execution, data theft, or address-bar spoofing.www.theregister.com - Articles: “the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot.”
- SupportedForever Security found vulnerabilities in Cursor, GitHub Copilot, Claude Desktop, VS Code, and Codex.www.theregister.com - Articles: “Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic’s Claude Desktop, VS Code, and Codex”
- SupportedAll five tools had embedded browsers with capabilities beyond those of conventional browsers.www.theregister.com - Articles: “All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers.”
- SupportedWeizman wrote that the browser enrichments undermined the traditional threat model in the ways quoted in the story.www.theregister.com - Articles: “Each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday report.”
- SupportedCursor’s integrated browser let a web page call the agent’s composer, potentially enabling prompt injection and host command execution.www.theregister.com - Articles: “Cursor’s integrated browser, however, allows a page to call the agent’s composer. The agent reads this as instructions and follows them, but the instructions remain hidden from human users. This opens the coding agent up to prompt injection attacks that could allow an attacker to execute commands on the host machine.”
- SupportedCursor silently patched the flaw on October 1.www.theregister.com - Articles: “the vendor silently patched the flaw on October 1.”
- SupportedThe Copilot browser-preview flaw could show a spoofed URL while loading a fraudulent site underneath.www.theregister.com - Articles: “This can be abused to trick the embedded browser into displaying a spoofed URL - such as github.com/login - in the address bar, while loading a fraudulent website - like a phishing page - underneath.”
- SupportedGitHub fixed the Copilot flaw in build 1.1.29 on October 13.www.theregister.com - Articles: “GitHub independently fixed the flaw in a later Copilot build (1.1.29) on October 13 without receiving a vulnerability report from Forever.”
- SupportedIn all three of Claude Desktop, Codex, and VS Code, local HTML files opened in the built-in browser could escape its boundaries and access other files.www.theregister.com - Articles: “All three of these vendors’ coding assistants allow local HTML files opened in the built-in browser to escape its boundaries and access other files.”
- Partly supportedAnthropic declined Forever’s Claude Desktop report as a “workspace trust” boundary issue.www.theregister.com - Articles: “Weizman said his team disclosed the issue to Anthropic on July 23, and the AI vendor declined the Claude Desktop bug report as invalid for a “workspace trust” gated security boundary.”
