Ethical Hacking News
Five popular AI developer tools have been found to contain critical vulnerabilities that can allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. The affected tools include OpenAI's Codex and Microsoft's VS Code, which remain unpatched. The vulnerabilities highlight the need for increased scrutiny of embedded browsers in AI developer tools and demonstrate a lack of urgency and a failure to address critical security issues.
Five popular AI developer tools have critical vulnerabilities that can allow attackers to execute code, read and steal files, or spoof browser address bars. The affected tools include OpenAI's Codex, Microsoft's VS Code, and GitHub Copilot, which remain unpatched. The vulnerabilities, dubbed "Embrace" by the researchers, can lead to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot. Cursor allows prompt injection attacks, while GitHub Copilot allows address bar spoofing. The remaining three tools, Claude Desktop, Codex, and VS Code, have vulnerabilities that allow local HTML files to escape boundaries and access other files. The lack of patching for these tools demonstrates a lack of urgency and a failure to address the critical nature of these vulnerabilities.
A recent discovery by researchers has shed light on a critical vulnerability in five popular AI developer tools, leaving many developers vulnerable to potential attacks. The vulnerabilities, which have not been patched, can allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. The affected tools include OpenAI's Codex and Microsoft's VS Code, which remain unpatched.
The researchers, from the AI security startup Forever Security, discovered the vulnerabilities in Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and Codex. They dubbed the class of vulnerability "Embrace," short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot.
One of the key vulnerabilities is in Cursor, which allows a page to call the agent's composer, enabling prompt injection attacks that could allow an attacker to execute commands on the host machine. This vulnerability was disclosed to the vendor on September 10, and they silently patched the flaw on October 1. However, the vendor did not publish a security advisory about the issue or respond to the researchers' disclosure.
Another critical vulnerability is in GitHub Copilot, which allows the page to change its address without loading a new page, making it vulnerable to address bar spoofing. This vulnerability was discovered on September 26 and independently fixed by GitHub in a later Copilot build. However, the researchers found that the flaw could be abused to trick the embedded browser into displaying a spoofed URL while loading a fraudulent website.
The remaining three tools, Claude Desktop, Codex, and VS Code, all have vulnerabilities that allow local HTML files opened in the built-in browser to escape its boundaries and access other files. These vulnerabilities were discovered by the researchers in July and August, and although the vendors have acknowledged the issues, they remain unpatched.
Anthropic, the vendor of Claude Desktop, initially declined the bug report as invalid for a "workspace trust" gated security boundary. However, after another security researcher, Noma Security, reported the same flaw, Anthropic accepted the report as valid. OpenAI, the vendor of Codex, did not respond to the researchers' disclosure, and the vulnerability remains unpatched.
Microsoft's VS Code also remains unpatched, despite the researchers disclosing the vulnerability on September 10. The vendor initially labeled the issue as an invalid workspace trust gated security boundary, but has not provided a patch or acknowledged the vulnerability.
These vulnerabilities highlight the need for increased scrutiny of embedded browsers in AI developer tools. The researchers' discovery demonstrates that even seemingly secure tools can have critical vulnerabilities that can be exploited by attackers.
As the use of AI and machine learning continues to grow, it is essential that developers and vendors prioritize security and take steps to address these vulnerabilities. The lack of patching for these tools demonstrates a lack of urgency and a failure to address the critical nature of these vulnerabilities.
The discovery of these vulnerabilities serves as a reminder that even the most secure-looking tools can have hidden weaknesses. As the development of AI and machine learning continues to advance, it is crucial that developers and vendors prioritize security and take steps to address these vulnerabilities.
In conclusion, the discovery of these vulnerabilities highlights the need for increased scrutiny of embedded browsers in AI developer tools. The lack of patching for these tools demonstrates a lack of urgency and a failure to address the critical nature of these vulnerabilities. It is essential that developers and vendors prioritize security and take steps to address these vulnerabilities to prevent potential attacks and protect user data.
Related Information:
https://www.ethicalhackingnews.com/articles/Embedded-Browsers-A-Critical-Vulnerability-in-5-AI-Developer-Tools-ehn.shtml
https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508
Published: Thu Oct 29 19:04:18 2026 by llama3.2 3B Q4_K_M
