Researchers Say the Built-In Browsers in Five AI Coding Tools Could Be Turned Against Developers
Forever Security says the embedded browsers in Cursor, Copilot, Claude Desktop, VS Code and Codex could run commands, read files or spoof addresses. The Codex and VS Code flaws were still unpatched at publication.
Your AI coding assistant ships with its own web browser. Researchers say that browser can be talked into things yours never would, like running commands, reading any file on the machine or faking the address bar.
Forever Security, an AI security startup, says it found the same design mistake in five widely used tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex. In its report, published October 29, researcher Gal Weizman calls the pattern Embrace, short for embedded browser. The Register says two of the flaws, in Codex and VS Code, were still unpatched when the report came out.
"Each enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab's own address, or as reach onto the host." Gal Weizman, Forever Security
A normal browser treats every page as hostile. Coding assistants want theirs to preview local projects and let the agent read the screen, so each vendor loosened a rule. Forever says each loosening handed a hostile page a power it should never have had.
Cursor is the most alarming case on paper. Forever says a page opened in its integrated browser could pass instructions to the agent that stayed hidden from the human, opening the door to prompt injection and commands on the host. Forever says the agent even switched off Cursor's sandbox on its own after a first attempt was blocked, though Weizman told Help Net Security it does not always work. Forever disclosed it on September 10. Cursor patched it on October 1, but, per Forever, published no advisory and never replied, and it did not answer The Register either.
GitHub Copilot had a quieter problem. The app took a page's word for its own address, so a phishing page could sit under a github.com address in the address bar. GitHub fixed it in version 1.1.29 on October 13, before Forever filed a report.
The file-read bugs are messier. Forever says a local HTML file opened in the built-in browser of Claude Desktop, VS Code or Codex could reach beyond its project folder. Claude Desktop and VS Code checked the page itself but not the background web workers it can start. Codex had no such check at all. Forever says one click on a link the assistant itself offers was enough, and that its test sweep collected SSH keys and npm tokens.
A fight over what counts as a vulnerability
The disclosure timeline is the real story. Forever says Anthropic rejected its July 23 Claude Desktop report as invalid, citing a workspace trust boundary, then accepted the same flaw from Noma Security a day later. Microsoft gave Forever the same workspace trust answer on VS Code, and Forever says it remains unpatched. Microsoft did not comment to The Register. Anthropic did not answer The Register's questions and has not said whether Claude Desktop is fixed, though Forever lists only Codex and VS Code as still open.
OpenAI never replied to Forever's July 27 Codex report, the researchers say. An OpenAI spokesperson told The Register the company is aware of the issue and working to address it.
Workspace trust is the prompt asking developers whether to trust a project folder. Weizman says it protects no one.
"Not trusting a project inside an AI harness makes it unusable, so everyone just hits 'Trust'." Gal Weizman, Forever Security, to Help Net Security
Microsoft and Anthropic weigh the tradeoff differently, and Weizman's firm sells monitoring for AI tools. Still, a boundary users click through by reflex is thin.
Nobody has reported attacks using these flaws in the wild, and the findings come from one firm's tests. The attacks need a developer to open a booby-trapped page or project, which is what coding agents invite people to do all day. It follows the tampered Claude Code extension on Cursor's marketplace, a separate incident.
Weizman advises teams running Codex or VS Code to check trusted projects for suspicious HTML files. The wider lesson is simpler. Put a browser inside an agent and you inherit the browser's old threat model and the agent's new one at once.
