Five AI developer tools had embedded browser flaws, researchers say

AI security startup Forever Security says it found vulnerabilities in five AI developer tools that use embedded browsers. The flaws could let attackers execute code on a host machine, read or steal files, or spoof browser address bars, according to a Thursday report. GitHub independently fixed one issue, while flaws in OpenAI's Codex and Microsoft's VS Code remain unpatched, the researchers said.

Cursor allowed hidden agent instructions

Cursor's integrated browser lets a web page call the agent's composer, and the agent may follow instructions that stay hidden from human users. This can open the coding agent to prompt injection attacks that could allow command execution on the host machine. Forever disclosed the issue on September 10, and Cursor silently patched it on October 1. The researchers said Cursor did not publish a security advisory or respond to the disclosure, and Cursor did not reply to The Register's request for comment.

GitHub Copilot address bar spoofing

GitHub Copilot's browser preview let a page tell the app its own address, and the app checked only whether the text looked like a web address. This could be abused to show a spoofed URL such as github.com/login in the address bar while loading a fraudulent website underneath. Forever found the flaw in Copilot 1.1.27 on September 26, and GitHub independently fixed it in Copilot 1.1.29 on October 13 without receiving a report from Forever. GitHub did not respond to The Register's request for comment.

Claude Desktop, Codex and VS Code file read flaws

The three tools allow local HTML files opened in their built-in browsers to access other files. Claude Desktop and VS Code let local pages access project folders, but researchers found those restrictions did not apply to web workers, so a local page could start a worker and bypass restrictions to reach any file on the machine. Codex had no such restriction, so a local page could read any file directly. Forever disclosed the Claude issue to Anthropic on July 23; Anthropic declined it as invalid for a workspace trust gated security boundary, but later accepted the same flaw after Noma Security reported it. Forever disclosed the Codex issue to OpenAI on July 27 and did not get a response; an OpenAI spokesperson told The Register the company is aware and working to address it. Forever disclosed the VS Code issue to Microsoft on September 10, and says Microsoft also labeled it invalid; the researchers claim it remains unpatched. Microsoft did not respond to The Register's request for comment.

Shared weakness in embedded browsers

All five tools share a common weakness: embedded browsers granted capabilities beyond those available to conventional browsers. Forever dubbed the class of vulnerability 'Embrace,' short for EMbedded BRowser. The flaws led to code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot. Four flaws were disclosed to affected vendors; GitHub independently fixed Copilot without receiving a report.

Sources: The Register