Researchers find 'Embrace' flaws in five AI developer tools; OpenAI, Microsoft bugs unpatched
Embedded browser flaws could allow code execution, data theft and address bar spoofing in popular developer tools
Researchers at security firm Forever Security have discovered vulnerabilities in five popular AI developer tools that could let attackers execute code on host machines, steal files, or spoof website addresses. The flaws, which affect Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex, stem from a common class of weakness the company calls 'Embrace', over-empowered embedded browsers. While Cursor and GitHub Copilot have been patched, flaws in VS Code and Codex remain unpatched, according to the researchers.