Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
VULNERABILITYAnthropicredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 2 updates
Who reported · 2 outlets
Help Net SecurityCyber Security News
Who and what is in it
Products