# Researchers exploit flaws in five AI coding assistants’ browsers

Digest AI · Society & Work · published 2026-10-29T07:10:00Z

Canonical: https://digestai.news/story/researchers-exploit-flaws-in-five-ai-coding-assistants-browsers

## Summary

Researchers at Forever Security found vulnerabilities in the embedded browsers of five AI coding tools: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code, and Anthropic’s Claude Desktop. Each tool violated at least one of three core browser security rules: running untrusted code, reading local files beyond their project folders, or allowing arbitrary address bar changes. In Codex and VS Code, attackers could read entire disk contents via a local HTML file, exposing SSH keys, `.env` files, and cloud credentials. Cursor allowed remote code execution after a single keypress, while Copilot displayed fake URLs in its tab list. Two of the flaws remain unfixed as of October 29, according to Forever’s Gal Weizman, who documented the findings in a technical report. Anthropic and Microsoft dismissed the reports, citing their ‘Workspace Trust’ prompts, which developers often bypass. GitHub and Cursor patched their issues in October, but OpenAI has not responded to Forever’s July 27 report. Weizman warns that developers routinely trust AI agents without scrutiny, enabling such attacks.

## Key points

- Forever Security found five AI coding tools violated browser security rules, letting attackers read files or run code
- Codex and VS Code remain unpatched as of October 29, risking full-disk access via a single local file
- Cursor and Copilot patched their flaws in October, but OpenAI has not addressed Codex’s unpatched vulnerability

## Why it matters

These flaws demonstrate how embedded AI agents in developer tools can bypass security controls, exposing sensitive data like API keys and credentials. Unpatched vulnerabilities in widely used tools like VS Code and Codex pose immediate risks to developers’ security practices.

## Sources

1. [Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop](https://helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities) (helpnetsecurity.com, 2026-10-29)

Part of the developing story: [Hijacked AI Coding Assistants Threaten Developers](https://digestai.news/thread/researchers-show-ai-coding-agents-can-be-hijacked-via-malicious-agents-md-files) (2 stories)

## Cite

Digest AI, "Researchers exploit flaws in five AI coding assistants’ browsers", 29 October 2026, https://digestai.news/story/researchers-exploit-flaws-in-five-ai-coding-assistants-browsers

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/researchers-exploit-flaws-in-five-ai-coding-assistants-browsers.json