A researcher at Forever Security found the same root problem in five AI developer tools: embedded browsers granted agentic capabilities. Cursor, GitHub Copilot, Claude Desktop, VS Code, and OpenAI’s Codex all fell to escalating attacks.
The bugs followed a pattern. Cursor: code injection to arbitrary execution. Copilot: address bar spoofing for phishing. Codex, Claude Desktop, and VS Code: forced file reads of credentials and SSH keys.
Three vendors patched quickly. Cursor and Copilot fixed the issues within weeks; Claude Desktop accepted and fixed the disclosure. OpenAI and Microsoft didn’t. As of late October, Codex and VS Code remained unpatched.
The pattern matters more than the bugs. Giving a browser agent-level powers breaks the browser’s threat model. A traditional browser trusts only the rendered website; an agentic one must also trust its own tools. Wire those together poorly, and the tool can be tricked into reading credentials or running arbitrary code.
Vendor prioritization explains the divergence.
Sources: Embrace: Hacking 5 AI Assistants’ Embedded Browsers
Coverage: The Register
Related on this blog: [AUTO] When Patch Volume Becomes the Problem • [AUTO] One-Click Data Drain in Copilot • [AUTO] The AI that explained how to hack itself