Forever Security researchers said on Oct. 29 that weaknesses in the built-in browsers of five AI developer tools could let harmful content run code, read files on a computer or fake a website address, and that the reported Codex and VS Code flaws had not been fixed by the time of publication.
The tools were Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. The researchers called the findings EMBRACE. The problems differed by product.
The researchers showed that Cursor could run code, that Copilot’s preview could show a false website address, and that Codex, VS Code and Claude Desktop could access local files. They traced the risks to browser features that gave AI assistants extra abilities to interact with webpages or local projects. In their tests, those extra abilities weakened familiar browser protections.
In one example, a local HTML file opened in a built-in browser could reach files outside its project folder, potentially exposing items such as SSH keys or developer tokens. The researchers said the method differed between tools. A background web worker bypassed folder limits in VS Code and Claude Desktop, while Codex did not check the folder in the tested case.
According to the reports, Cursor had fixed its reported issue on Oct. 1. GitHub separately fixed Copilot’s flaw in an October update, according to the reports. Forever said Codex and VS Code had not been fixed when its findings were published.
Forever said OpenAI had not responded to its report, while Microsoft cited Workspace Trust. The findings concern distinct issues in specific products. The stated unpatched status reflects the reports’ publication date, Oct. 29.