Researchers Uncover Critical Vulnerabilities in AI Coding Assistants' Browsers
Flaws in the embedded browsers of popular AI coding tools like VS Code, Cursor, and Copilot allow malicious web pages or local files to compromise developer systems.
Researchers at Forever Security have identified significant vulnerabilities within the built-in browsers of several prominent AI-powered coding assistants, including Microsoft's VS Code, Cursor, GitHub Copilot, OpenAI's Codex, and Anthropic's Claude Desktop. These flaws, collectively termed EMBRACE by the researchers, exploit the trust developers place in these integrated environments, allowing malicious web pages or local files to access sensitive system resources.
In all five affected products, the embedded browsers failed to uphold fundamental security principles. Specifically, the vulnerabilities permit web pages or local files to execute commands on the user's computer, read arbitrary local files, or spoof the browser's address bar. These breaches stem from vendors loosening browser security to enable AI features like local project previews or tab content analysis, inadvertently creating pathways for attackers.
Two of the most concerning vulnerabilities, found in OpenAI's Codex and Microsoft's VS Code, remain unpatched as of late October 2026. Developers using these tools are at risk of losing critical information such as SSH keys, cloud credentials, and API tokens with a single click, simply by opening a compromised project. The attack typically involves a developer being tricked into opening a malicious HTML file within a project, which then leverages the browser's relaxed security to read sensitive files.
Anthropic and Microsoft have reportedly declined to patch certain vulnerabilities, citing their 'Workspace Trust' feature, which prompts users to trust project folders. Researchers argue this prompt offers little real protection, as developers often click 'Trust' to make the AI tools usable. Anthropic did accept a similar report from another security firm shortly after declining Forever Security's findings, while OpenAI has not yet responded to its report.
Cursor and GitHub Copilot have since released patches for their respective vulnerabilities. In Cursor, a malicious web page could trick the AI agent into bypassing its own sandbox to execute commands, which was fixed three weeks after disclosure. GitHub Copilot's vulnerability allowed a malicious page to display a fake address bar, a flaw that was patched before Forever Security even filed a report.
The researchers emphasize that the trust prompt is a false sense of security, as developers often bypass it for convenience. This highlights a broader trend where the integration of AI into development workflows introduces new attack vectors that traditional security measures may not adequately address. The potential for AI agents to circumvent their own safeguards, as observed in Cursor's case, further underscores the need for vigilance.
For developers still using the unpatched Codex or VS Code, Forever Security recommends manually reviewing project configuration files and inspecting all HTML files for the described exploit patterns. The ease with which these tools can be manipulated to read an entire disk underscores the critical need for vendors to prioritize security in AI-integrated development environments and for users to remain cautious about the projects they interact with.