Critical Vulnerabilities Discovered in Five Major AI Developer Tools
Embedded browser flaws expose developers to code execution, data theft, and phishing risks.
1The Embrace Vulnerability Class
Forever Security identified a new vulnerability class dubbed Embrace, affecting five popular AI developer tools. These tools utilize embedded browsers with excessive permissions that bypass traditional security models. By granting these browsers capabilities beyond standard web environments, the tools inadvertently allow attackers to execute code, steal local files, or spoof address bars.
2Cursor Code Execution Risks
Cursor contained a flaw allowing arbitrary code execution on host machines. The integrated browser permitted web pages to send hidden instructions to the agent’s composer, facilitating prompt injection attacks. Researchers disclosed this issue on September 10, and the vendor silently patched the vulnerability on October 1 without issuing a public security advisory.
3GitHub Copilot Address Spoofing
GitHub Copilot version 1.1.27 was susceptible to address bar spoofing due to improper URL validation. The application allowed pages to dictate their own address, enabling attackers to display fraudulent URLs while loading phishing content. GitHub independently resolved this specific flaw in build 1.1.29, released on October 13, without external reporting.
4File Access in Claude Desktop
Anthropic’s Claude Desktop allowed local HTML files to escape sandbox boundaries via browser web workers. Although the vendor initially rejected the report as a workspace trust issue, they later accepted a similar finding from Noma Security. The flaw permits unauthorized access to sensitive files residing within the user's project folders.
5Unpatched Flaws in Codex
OpenAI’s Codex remains vulnerable to arbitrary file reading, as the tool lacks sufficient restrictions on its embedded browser. Researchers disclosed the finding on July 27, but the company has not yet implemented a fix. OpenAI confirmed awareness of the issue and stated they are currently working toward a security resolution.
6VS Code Security Boundaries
Microsoft’s VS Code also suffers from an unpatched arbitrary file read vulnerability. Similar to Claude Desktop, the tool fails to properly restrict web workers, allowing local pages to access files outside intended project boundaries. Microsoft categorized the report as a workspace trust issue, and the vulnerability currently remains open for exploitation.
7Common Security Model Failures
The core issue across all five tools is the enrichment of embedded browsers beyond standard security constraints. By allowing these browsers to act as agents with host-level authority, developers have inadvertently created new attack vectors. These tools prioritize functional integration over the strict isolation required to protect the underlying host machine.
8Implications for AI Development
This discovery highlights the significant security risks inherent in integrating AI agents with local file systems and browsers. As these tools become standard in development workflows, vendors must re-evaluate their threat models. Developers should remain cautious of the permissions granted to AI-powered coding assistants until these fundamental architectural flaws are addressed.