GitHub Copilot
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Help Net SecurityEmbedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Recent news
Roundup of AI coding agent security issues for November 2026
Adversa AI's November 2026 roundup highlights three AI coding agent issues: a remote code execution flaw in Copilot involving a trailing dot, a child Claude session that skips hook consent, and an opencode fix that has no CVE. The article gives no further technical detail, so the scope and affected versions are not stated.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.