Security flaws found in five AI coding tools, two still unfixed

Security researchers say they found flaws in five popular AI coding tools, and two of them are still not fixed. The tools are Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex. The startup Forever Security says the bugs could let attackers run code on a developer's computer, steal files, or fake a web address.

What went wrong

All five tools have a small web browser built into the app. Forever says each one gave that browser extra powers a normal browser does not have. Those extras broke the usual safety rules. The firm calls this type of flaw "Embrace," short for embedded browser.

In Cursor, a web page could pass hidden instructions to the AI agent, and the agent would follow them. The person using it would not see them. That could let an attacker run commands on the computer. In GitHub Copilot, a page could tell the app what its own address was, so a fake page could appear under a trusted address such as github.com/login.

In Claude Desktop, VS Code and Codex, a local web page could reach files outside its project folder. In Claude Desktop and VS Code, a background browser feature called a web worker got around the limits. In Codex, a page could read any file directly.

What the companies did

• Cursor: told September 10, patched October 1, with no public notice and no reply to the researchers.
• GitHub Copilot: fixed on October 13 in build 1.1.29, without a report from Forever.
• Claude Desktop: Anthropic first called the report invalid, then accepted it after another firm reported the same flaw.
• Codex: reported July 27, no response, still unpatched, researchers say.
• VS Code: Microsoft called it invalid, and researchers say it is still unpatched.

The Register said Cursor, GitHub, Anthropic, OpenAI and Microsoft did not answer its questions. Anthropic and Microsoft rejected the reports as an invalid "workspace trust" issue, according to Forever.

Who is at risk

The main risk is to developers who use the affected setups, and to the businesses that rely on their work. An attack would need the person to open a file or page the attacker controls. The material does not say whether any of these flaws have been used in real attacks.

What to do

Keep these tools updated, since fixes may arrive quietly, as Cursor's did. Avoid opening HTML files or web pages from sources you do not trust inside the built-in browsers. Businesses can ask their developers which of these tools they use and whether they are on the latest versions.