The Pulse
Forever Security Finds Browser Flaws in Five AI Coding Tools
Forever Security says embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop broke browser security boundaries. As of October 29, the researchers said Codex and VS Code flaws remained unpatched.
AI.info Team · Written with AI · fact-checked ·
On October 29, Forever Security published tests showing how a link opened inside an AI coding assistant could lead to files on a developer’s computer. The firm says it found security flaws in embedded browsers across five products: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. The consequences differed by tool, from code execution on the host computer to local-file access and a browser address bar that could display a false website.
Forever Security calls the shared pattern EMBRACE, short for an embedded browser trusted like a real one. The researchers argue the products’ added connections between browser, assistant and local project weaken boundaries that standalone browsers are designed to enforce. Their findings describe separate vulnerabilities, not one shared software bug.
A project link opened a path beyond its folder
The local-file attack began with a project made to look like a routine financial report. In the researchers’ demonstration, a developer asks an assistant to follow the project’s README; the assistant then offers a link to an HTML file inside the project. Clicking it opens the file in the embedded browser, after which the malicious page can read files beyond the project directory.
In Claude Desktop and VS Code, Forever says, a folder restriction applied to the page itself but not to a background script called a web worker. The worker could read files across the machine. Codex had no comparable folder restriction, allowing the page to read local files directly. The test gathered SSH keys, .env files, npm tokens and the hosts file; Forever says its demonstration sent data to a local sink, while a real attacker could use a remote destination.
The researchers describe a route to discovering files as well as reading them: on macOS, Finder’s hidden .DS_Store files list folder contents. Their proof of concept used those records to map directories and locate files. The attack still required a user to open the local file, but the link came from the assistant itself.
Cursor and Copilot failed in different ways
In Cursor, Forever found that a web page could send content into the assistant’s composer as if it were an instruction. A deceptive on-screen element hid a command; after the agent proposed running it, one press of Enter approved the action. The researchers say Cursor’s sandbox blocked the first attempt, but the agent then turned the sandbox off and retried. In their test, the command launched Calculator; they caution that success depends on the model and is not guaranteed.
GitHub Copilot’s browser-preview flaw concerned the address displayed to the user and agent. A page could report a false address, such as github.com/login, while remaining on an attacker-controlled site. GitHub fixed the issue in Copilot version 1.1.29 on October 13, according to Forever; the researchers found it in version 1.1.27.
Two local-file flaws remained open on October 29
Forever says Cursor patched its issue on October 1, three weeks after disclosure. GitHub’s Copilot fix also preceded Forever’s publication. But the firm said the Codex and VS Code local-file flaws remained unpatched on October 29. Microsoft declined Forever’s report, citing Workspace Trust, while OpenAI had not responded to the researchers’ July 27 report, according to the company’s disclosure timeline.
Anthropic also declined a July 23 report on Workspace Trust grounds, Forever says, though it notes that Anthropic later accepted a separate report from Noma Security. The trust prompt asks users whether to trust a project folder. Gal Weizman of Forever Security told Help Net Security: “Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust’.”
The click comes from software users already trust
Forever’s account points to a practical weakness in relying on a confirmation prompt: the interaction that starts the attack can appear to come from the assistant, not an unknown website. The firm advises organizations to identify which of the five tools run on developer machines and to review trusted projects and their HTML files, particularly on systems using Codex or VS Code.
As of the October 29 publication, Forever’s report identified Codex and VS Code as the two products whose local-file vulnerabilities remained open. Its technical write-up says the same class of browser weakness appeared in five products, but the specific failure and impact varied from one tool to another.