Researchers find bugs in five AI developer tools as Codex and VS Code flaws stay unpatched

The class

Forever Security's research covers five popular AI developer tools — Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex — and identifies a common flaw class the researchers call 'Embrace': each tool ships an embedded browser (webview) that is effectively a regular browser with a privileged bridge into the host environment. Anything that webview renders — a README preview, a docs page an agent opened, an untrusted repo — becomes attack surface.

In Cursor, a webpage could call the agent's composer, and the agent treated the page content as instructions (prompt injection), allowing an attacker to execute commands on the host. GitHub Copilot let pages spoof the address bar: the app checked only that a string looked like a URL starting with http, https or file, so a phishing page could be displayed under a spoofed github.com/login address.

The unpatched flaws

Claude Desktop, Codex and VS Code allowed local HTML pages to read arbitrary files on the machine, often by abusing web workers. Claude Desktop has since been fixed. OpenAI's Codex and Microsoft's VS Code flaws remain unpatched, per the researchers, with the Codex bug disclosed on 27 July and the VS Code bug on 10 September.

The Codex case is notable: Forever Security says the flaw was disclosed to OpenAI on 27 July, received no response, and as of the report OpenAI had not fixed it or replied. A local HTML page opened in Codex's browser could read any file directly without needing a web worker. Cursor patched its RCE silently on 1 October without a security advisory.

Why it matters

Developers increasingly let AI agents open web pages, preview docs and parse links — which hands untrusted content to a privileged webview. The 'Embrace' class means a malicious README, a compromised docs site or a crafted repo can move from 'web content' to 'code execution' or 'file disclosure' on the developer's machine.

That matters because those machines hold source code, API keys, deployment credentials and access to production systems. Two of the five tools still exposing arbitrary file read (Codex, VS Code) means large numbers of developers using affected configurations are exposed with no patch available; disabling built-in preview/browser features or opening untrusted repos in a separate VM is the practical stopgap.

Caveats

The findings are from an external research firm and the specific impact depends on configuration and how the embedded browser is used; not every developer workflow triggers the vulnerable path. The unpatched status of Codex and VS Code is as reported by Forever Security at disclosure time, and vendors may have shipped fixes since.

Address-bar spoofing in Copilot and the RCE chain in Cursor required specific conditions (rendering untrusted content in the embedded browser) but illustrate the breadth of the flaw class across mainstream tools.

The precedent

This is not Forever Security's first finding on AI coding tools. Earlier research showed a malicious agent's .md file in a repository could hijack Codex and Claude Code by injecting instructions into the files agents read. The new 'Embrace' work extends that theme: the attack surface is not just the agent's prompt context but the rendering engine itself.

The embedded-browser design is convenient - previews, docs and links work inside the tool - but it reuses web technologies (web views, web workers, IPC bridges) that were never designed to be a privileged gateway into a developer's machine. Each new AI coding tool that ships a webview inherits the same structural risk.

The fix and the residual risk

Cursor patched its RCE silently on 1 October, GitHub fixed Copilot's address-bar spoofing in build 1.1.29 on 13 October, and Claude Desktop has been updated for the file-read issue, per the researchers. That leaves Codex and VS Code still open on file-read at the time of reporting.

The practical questions for developers: are you opening untrusted links, READMEs or docs inside your AI tool? Can untrusted pages reach the webview? Do the deployed versions include the vendor fixes? Until the remaining flaws are patched, the stopgap is to avoid rendering untrusted content inside the tools and to treat any web content the agent fetches as potentially hostile input.

Disclosure and response

The disclosure timeline matters for developers trying to assess their exposure. Cursor was notified 10 September, patched silently 1 October. GitHub's fix shipped 13 October in build 1.1.29. Claude Desktop updated after researchers reported the file-read path. For Codex the disclosure went to OpenAI on 27 July with no response, and for VS Code on 10 September with no patch as of the report.

Silent patching in particular is a transparency issue: if a vendor fixes a vulnerability without a security advisory, users do not know to update, and the severity of the original bug is not communicated. As AI coding tools become default developer infrastructure, the community is still learning what security expectations to set for them.

The broader recommendation from the researchers is to treat embedded preview and browser features as the risk they are: check which JS and IPC bridge APIs the webview exposes, whether local HTML or file:// pages can load at all, and disable those features when handling untrusted repositories.