AI Coding Tools Share a Browser Flaw Pattern, and Two Fixes Are Still Missing

Security startup Forever Security has identified vulnerabilities in five popular AI developer tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code and OpenAI's Codex. Depending on the tool, the flaws could let attackers run code on a host machine, steal files or fake the address shown in a browser. The researchers say the Codex and VS Code issues remain unpatched, which could put developers using affected configurations at risk.

All five share one weakness: each tool's embedded browser was given extra abilities that an ordinary browser does not have. Forever calls this class of flaw "Embrace", short for EMbedded BRowser. The researchers say it led to code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot. In Cursor, a web page could pass hidden instructions to the coding agent, which treated them as commands. This is known as prompt injection. Forever says it reported the issue on September 10 and Cursor quietly patched it on October 1, without publishing an advisory or replying to the researchers. In Copilot, the app let a page report its own address, so a page could misrepresent where it came from. GitHub fixed this independently, without a report from Forever.

Forever disclosed four of the flaws to the affected vendors. Cursor did not respond to The Register's request for comment. This summary covers only the opening of the original report, so details on the Claude Desktop, Codex and VS Code issues are not included here.