Sign inGet the app

Vulnerability · 2 sources · latest 10h

Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing

Severity
High
Sources
2

What happened

Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.

For IT people · Written by AI from 2 sources · Wrong?

Read the full story at the sourceAsk about this story

Full story timeline · 2 updates

  1. Thu 29 OctoberResearchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude DesktopHelp Net Security
  2. Fri 30 OctoberResearchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded BrowsersCyber Security News

Who reported · 2 outlets

Help Net SecurityCyber Security News

Report a problem

Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing · RedTeamDaily