Common Vulnerability Found in 5 AI Development Tools; Codex and VS Code Remain Unpatched

Security firm Forever Security on October 29 reported a vulnerability common to the embedded browsers of developer-assistance tools. OpenAI's "Codex" and Microsoft's "Visual Studio Code (VS Code)" remained unpatched at the time of disclosure, and opening a malicious HTML file could allow files outside the project to be read.

A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's "Claude Desktop." The series of issues was named "EMBRACE (EMbedded BRowser)" and classified into three types: file reading, command execution, and address spoofing. The five products do not all an identical flaw, however, and the way the impact manifests differs from product to product.

The core of the problem lies in the fact that each tool grants its embedded browser more privileges than a normal browser. In the report, Weizman noted that each tool "extended the embedded browser beyond the boundaries a normal browser permits, and that extension undermined the conventional threat model." Specifically, he explained that three aspects—the input path to the AI agent, the authority to determine a tab's address, and the reach into the host environment—blurred the boundaries.

In Codex, files outside the project could be read directly from an opened HTML file. Claude Desktop and VS Code restricted the scope of files a page could read to within the project, but this restriction did not extend to "Web Workers," which execute processing behind the page. The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data.

For an attack to succeed, the user must open a malicious HTML file in the embedded browser. The research team also demonstrated a flow in which, when it asked the AI to prepare according to the project's instructions, the AI presented a link to the HTML file in question. It noted the risk that users may trust and open a link presented by the AI.

In Cursor, the team demonstrated a technique in which a page sends a malicious instruction, invisible on screen, into the AI's input field, causing the AI to execute a command. The attack requires the user to press the Enter key on the execution-confirmation screen, and success also depends on the AI model used, according to the team. This issue was fixed on October 1. In GitHub Copilot, version 1.1.27 was found to be able to show both the user and the AI the address of a site different from the actual one. GitHub fixed it on October 13 in version 1.1.29.

Vendors' responses have diverged. According to the research team, Microsoft positioned the mechanism that asks users whether to trust a working folder as a security boundary and did not accept the VS Code report as a valid vulnerability. OpenAI was reportedly notified of the Codex issue on July 27 but did not respond. Weizman explained that Anthropic initially declined the Claude Desktop report as an issue bounded by "workspace trust," but accepted it as a valid report the following day after another security firm, Noma Security, reported the same flaw.

The latest report is based on demonstrations in the researchers' own environments and does not indicate the number of users harmed by this technique.

AI coding-assistance tools have spread rapidly over the past year and are becoming a standard working environment at development sites. Embedded browsers are marketed for the convenience of checking AI-generated previews on the spot, while the apps are given privileges that ordinary browsers do not have. The latest issues show that a design that relaxed the conventional threat model in exchange for convenience has produced similar holes across multiple vendors. Development tools routinely come into with highly confidential information such as authentication tokens and cloud connection keys, and delays in patching could affect the entire supply chain.