Researchers have found critical security flaws in five popular AI developer tools, including those from OpenAI and Microsoft. The flaws allow attackers to execute code, steal files, or spoof browser address bars — posing risks to developers using these tools.
What Happened
Security firm Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic’s Claude Desktop, Microsoft’s VS Code, and OpenAI’s Codex. These tools are widely used by software engineers in daily development tasks like code generation and debugging.
Four of the flaws were formally reported to vendors. GitHub fixed a Copilot issue without receiving a report from Forever. The remaining flaws remain unpatched or were dismissed by vendors as outside their security scope.
Key Vulnerabilities
Cursor: Arbitrary Code Execution
Cursor’s embedded browser lets web pages trigger the AI agent’s composer. The agent runs these inputs as if from a user, but developers don’t see them. This creates a prompt injection risk.
Attackers could trick the agent into running commands — like opening apps or accessing files — on the host machine.
Forever disclosed the flaw on September 10. Cursor patched it silently on October 1. It did not publish a security advisory or respond to follow-up requests.
GitHub Copilot: Address Bar Spoofing
Normal browsers don’t let pages change the address bar without reloading. Copilot allows updates without a refresh.
It only checks if text starts with ‘http’, ‘https’, or ‘file’. It doesn’t verify where the page actually loads.
An attacker could show a fake GitHub login URL. Users might enter credentials, leading to account theft.
GitHub fixed the issue in version 1.1.29 on October 13. It did not respond to The Register’s request for comment.
Claude Desktop, VS Code, and Codex: Arbitrary File Read
These tools let local HTML files access files outside project folders. This happens through web workers — background JavaScript threads.
Both Claude Desktop and VS Code let local pages start workers. Those workers bypass security limits and access any file on the machine.
Codex is more vulnerable. It doesn’t use web workers. A local file can directly read any file on the system.
Anthropic initially rejected the report as invalid, citing a ‘workspace trust’ boundary. A day later, Noma Security reported the same flaw. Anthropic accepted it as valid.
Forever reported the Codex flaw to OpenAI on July 27. No response came. The flaw remains unpatched. OpenAI says it’s aware and working on a fix.
Microsoft labeled the VS Code flaw as an invalid ‘workspace trust’ issue. No patch has been issued. Microsoft did not respond to requests for clarification.
Why It Matters
These tools are central to modern software development. Developers rely on them for real-time suggestions and automation.
If compromised, the risks extend beyond one machine. They could lead to data theft, intellectual property loss, and wider supply chain breaches.
Security Design Gaps
AI tools are built for usability, not security. Embedded browsers — once a convenience — now act as major attack surfaces.
These tools lack standardized security models. Without clear rules for isolating and monitoring embedded systems, similar flaws may appear in future tools.
What to Watch Next
As AI tools grow in use, more frequent security audits are expected. Best practices for securing embedded browsers in AI apps may emerge.
Users should update tools to the latest version and check for official security advisories. In the absence of patches, disabling embedded browser features or using sandboxed environments is recommended.
For more details, see the original report at The Register.
Sources & further reading
Featured image: original publisher image. Via original publisher. Image source
