Security Researchers Find Unpatched Vulnerabilities in OpenAI Codex and Microsoft VS Code Among Five AI Developer Tools
Published · updated · curated by AI Is Going Just Great
Source: assets.theregister.com ↗
Each tool "enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model."
AI security startup Forever Security found exploitable flaws in five widely used AI coding tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code, and OpenAI's Codex. The bugs share a common root cause the researchers called "Embrace" (EMbedded BRowser): each tool's built-in browser was granted capabilities beyond what a normal browser allows, opening the door to prompt injection, arbitrary file reads, and address-bar spoofing attacks against developers using affected configurations.
Of the five, only Cursor and GitHub Copilot have been fixed. Cursor silently patched its code-execution flaw on October 1 without publishing a security advisory; GitHub independently fixed its address-bar spoofing bug without even receiving a report from the researchers. Anthropic initially rejected the Claude Desktop file-read bug as invalid, then accepted an identical report from a different firm the next day. OpenAI acknowledged the Codex flaw but has not patched it since disclosure on July 27. Microsoft labeled the VS Code bug an invalid "workspace trust gated security boundary" issue; it also remains unpatched.