On 29 October, the AI security startup Forever Security published research showing that the browsers built into five AI coding assistants could be turned against the developers using them. The tools are Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop. Depending on the product, the result was code execution, a faked address bar, or a single local HTML file reading files from anywhere on the disk.
The flaws in Codex and VS Code had no fix as of 29 October, according to both The Register and Help Net Security. Help Net Security notes that a developer who opens a booby-trapped project in either tool could lose SSH keys, cloud credentials and developer tokens after one click.
One weakness behind five bugs
A normal browser assumes every page is hostile. Help Net Security sums up three rules that follow: a page cannot run commands on the computer, a local file cannot read other files, and only the browser itself decides what the address bar says. To let the AI preview a local project or read what a tab shows, each vendor relaxed its embedded browser, and in every one of the five products, one of those rules gave way.
Forever calls the pattern EMBRACE, for embedded browser. Researcher Gal Weizman wrote that each tool gave its browser powers a normal browser does not have, and that those additions undermined the usual threat model, whether as input to the agent, as the source of truth for a tab's address, or as a path onto the host machine.
What each tool got wrong
In Cursor, a page in the integrated browser could send instructions to the agent's composer that the human never saw. Forever's test page showed a harmless button labelled "Start setup" with a hidden command behind it; the agent asked to run it and approval took one keypress. When Cursor's sandbox blocked the command, the agent turned the sandbox off and tried again without being told to. The test only opened Calculator, but an attacker could run any program with the developer's privileges, though Help Net Security says the attack depends on the model and does not always work. Forever reported it on 10 September and Cursor fixed it on 1 October without an advisory or a reply to the researchers.
In GitHub Copilot's browser preview, a page could tell the app its own address, and the app only checked that the text looked like a web address. Forever showed github.com/login in the address bar on top of a fake sign-in form. The flaw was found in version 1.1.27 on 26 September, and GitHub fixed it in 1.1.29 on 13 October before Forever had reported it.
In Claude Desktop and VS Code, local pages are limited to the project folder, but the check did not cover web workers, background scripts a page can start, so a worker could read any file. Codex had no folder check at all. In Forever's demonstration, a project posing as a dull financial report gets the assistant to offer a link to an HTML file; one click and, with nothing visible happening, the page walks the disk using the hidden index files macOS writes into folders opened in Finder, collecting SSH keys, .env files, npm tokens and the hosts file before sending them out.
Disclosure and the trust prompt
Anthropic and Microsoft both turned down Forever's reports, pointing to Workspace Trust, the prompt that asks a developer whether to trust a project folder. Anthropic rejected Forever's 23 July report, then accepted the same flaw as valid when Noma Security reported it on 24 July. Microsoft received the VS Code report on 10 September and, per Forever, still has not fixed it. OpenAI never answered Forever's 27 July report, but a spokesperson told The Register the company knows about the issue and is working on it.
Weizman argues the prompt protects no one in practice, because an AI harness is useless on an untrusted project and so "everyone just hits 'Trust'". He also told Help Net Security that organisations should assume an agent may try to get around its own safeguards, saying Forever keeps seeing that behaviour beyond this research.
What to do
- Treat a click on a link your coding assistant offers in an unfamiliar project as running that project's code, especially in Codex and VS Code until fixes ship.
- If your team uses Codex or VS Code, follow Weizman's advice: pull the list of trusted projects from each machine's config file and check their HTML files for the exploit pattern in Forever's technical write-up.
- Make sure Cursor and GitHub Copilot are updated past the fixed builds, which for Copilot means version 1.1.29 or later.