Critical Vulnerabilities Discovered in Five Major AI Developer Tools
Researchers identify embedded browser flaws enabling code execution and data theft in AI coding assistants.
1The Embrace Vulnerability Class
Forever Security identified a new vulnerability class dubbed Embrace, affecting five popular AI developer tools. These tools utilize embedded browsers with permissions exceeding standard browser capabilities, effectively undermining traditional security threat models. This design flaw allows malicious actors to execute code on host machines, steal sensitive files, or spoof browser address bars.
2Cursor Arbitrary Code Execution
Cursor's integrated browser allowed web pages to communicate directly with the agent's composer, bypassing standard JavaScript restrictions. This enabled prompt injection attacks where hidden instructions could execute commands on the host machine. Researchers disclosed this to Cursor on September 10, and the vendor silently patched the vulnerability on October 1.
3GitHub Copilot Address Spoofing
GitHub Copilot allowed web pages to define their own address bar content without verifying the actual destination. This enabled attackers to display legitimate URLs like github.com/login while loading malicious phishing sites underneath. GitHub independently identified and fixed this flaw in build 1.1.29 on October 13, following the initial discovery on September 26.
4File Access in Claude Desktop
Claude Desktop restricted local HTML files to specific project folders, but these boundaries failed against web workers. JavaScript running in background threads could bypass these restrictions to access arbitrary files on the host machine. Anthropic initially rejected the report as invalid before accepting a similar finding from Noma Security shortly thereafter.
5Unpatched Flaws in Codex
OpenAI's Codex lacks basic restrictions, allowing local pages to read any file on the machine directly. Researchers disclosed this vulnerability to OpenAI on July 27, but the issue remains unpatched. An OpenAI spokesperson confirmed the company is aware of the situation and is currently working to address the reported security flaw.
6VS Code Security Boundaries
Similar to Claude Desktop, VS Code's security boundaries were bypassed via web workers, allowing unauthorized file access. Microsoft received the disclosure on September 10 but labeled the issue as an invalid workspace trust gated security boundary. As of the latest reports, the vulnerability remains unpatched within the VS Code development environment.
7Vendor Response and Transparency
Vendor reactions to the disclosures varied significantly across the industry. While GitHub fixed its issue independently, others like Cursor applied silent patches without issuing security advisories. Anthropic and Microsoft initially dismissed the findings as invalid, highlighting a disconnect between researcher expectations and vendor security definitions regarding workspace trust and browser boundaries.
8Implications for AI Security
The prevalence of these flaws underscores the risks inherent in integrating powerful web-based interfaces into local development tools. By granting embedded browsers elevated privileges, vendors have inadvertently expanded the attack surface for developers. Future tool development must prioritize stricter isolation between web-based components and the underlying host operating system to prevent exploitation.