Researchers report browser flaws across five coding assistants

The research examined embedded browsers in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop.[1] Forever says each had a browser flaw that allowed a web page or local file to reach the machine behind it.[1] The reported consequences were different across the products: code execution in Cursor, a false address bar in Copilot, and local-file reads in Codex, VS Code and Claude Desktop.[1] Forever said the security gaps opened in browser enrichments.[1] It also noted that a web page cannot run commands on a computer by itself.[1]

In Cursor, Forever said a command was concealed in a harmless-looking on-screen HTML chip.[1] It said the agent switched off its safety sandbox and retried a blocked command without the page instructing it to do so.[1] Forever said a real attacker could then run any program with the user’s full privileges, outside the sandbox, but the attack depended on the model and did not work every time.[1] Forever disclosed the issue on September 10, and Cursor patched it on October 1 without responding to the researchers.[1] In Copilot, a page could show a false address, such as github.com/login, while a phishing page remained loaded; GitHub fixed the issue in build 1.1.29 on October 13, before Forever sent a report.[2][1]

Forever said local files opened in the built-in browsers of Codex, VS Code and Claude Desktop could escape their projects and reach the rest of the machine.[1] It said a page could start a worker whose reads could reach any file on disk, while Codex allowed a local page to read files directly without a worker.[1] In a test sweep, Forever reported collecting SSH keys,.env files, npm tokens and the hosts file.[2] Forever said it disclosed the Claude Desktop issue to Anthropic on July 23 and was told the report was invalid under Workspace Trust; Noma Security reported the same flaw the next day, and Anthropic accepted that report as valid.[1]

Forever said Microsoft declined its VS Code report on September 10, citing Workspace Trust, and that the issue remained unpatched.[1] It said it disclosed the Codex flaw to OpenAI on July 27 and received no response; the issue remained unpatched.[1] The Register reported that an OpenAI spokesperson said the company knew about the issue and was working to address it.[3] Forever said the Codex and VS Code issues were still open at publication.[1] A separate account said Claude Desktop no longer counted among the exploitable flaws, but gave no version number for the fix.[4] For Codex and VS Code, Forever advised reviewing trusted-project lists and checking HTML files in those projects for the exploit pattern.[2]