--- title: Researchers find bugs in 5 AI developer tools, with... description: Security researchers at Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code, and Codex. Each... canonical: https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched | daily.dev og:description: Security researchers at Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code, and Codex. Each... og:url: https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl og:image: https://api.daily.dev/og/posts/1Y5vx9HjL.png og:image:alt: Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched **[The Register](https://daily.dev/sources/theregister)** · 5 min read · 0 upvotes · 1 comments ## Summary Security researchers at Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code, and Codex. Each tool's embedded browser grants capabilities beyond a normal browser, a flaw class Forever calls 'Embrace'. In Cursor, a webpage could call the agent's composer and could allow an attacker to execute commands on the host via prompt injection; Cursor silently patched it on October 1. GitHub Copilot let pages spoof the address bar, fixed in build 1.1.29. Claude Desktop, Codex, and VS Code allowed local HTML pages to read arbitrary files, often by abusing web workers. OpenAI's Codex and Microsoft's VS Code flaws remain unpatched, according to the researchers, with the Codex bug disclosed on July 27 and the VS Code bug on September 10. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the Codex embedded browser vulnerability patched yet? No, the arbitrary file read vulnerability in OpenAI's Codex remains unpatched. Forever Security disclosed the flaw to OpenAI on July 27, received no response, and as of the report OpenAI had not fixed it or replied to inquiries about a fix. A local HTML page opened in Codex's browser could read any file on the machine directly, without needing a web worker. _Developers relying on Codex can track unresolved security issues like this one via daily.dev._ ### How did the Cursor arbitrary code execution bug work? Cursor's integrated browser let a webpage call the agent's composer, and the agent treated page content as hidden instructions it would follow, enabling prompt injection that could execute commands on the host machine. Researchers disclosed it to Cursor on September 10, and Cursor silently patched it on October 1 without a security advisory. _Teams adopting AI coding agents like Cursor can follow such security disclosures on daily.dev._ ### What is the GitHub Copilot address bar spoofing vulnerability? GitHub Copilot's embedded browser let a webpage report its own address rather than verifying where the tab actually pointed, so the app only checked that the string looked like a URL starting with http, https, or file. This allowed attackers to display a spoofed address like github.com/login while loading a phishing page underneath. GitHub fixed it in Copilot build 1.1.29 on October 13. _Developers evaluating Copilot's security posture can keep up with disclosures like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@mrucnguyen** · 0 upvotes > The interesting part isn't the individual bugs but the class: an embedded webview in a dev tool is effectively a browser with a privileged bridge, so anything it renders (a README preview, a docs page the agent opened) becomes attack surface. A quick check when evaluating these tools is to look at which JS/IPC bridge APIs the webview exposes and whether local HTML or file:// pages can load at all. Since the researchers report two of the five still unpatched, disabling built-in preview/browser features or opening untrusted repos in a separate VM is a reasonable stopgap. ## Similar posts on daily.dev - [How AI Coding Tools Crushed the Endpoint Security Fortress](https://daily.dev/posts/how-ai-coding-tools-crushed-the-endpoint-security-fortress-oivfawpcr) · Dark Reading · 1 upvotes · 0 comments - [Researchers Uncover 30\+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks](https://daily.dev/posts/researchers-uncover-30-flaws-in-ai-coding-tools-enabling-data-theft-and-rce-attacks-getxq9s6s) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched","url":"https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl"},"datePublished":"2026-10-29T23:16:04.653Z","dateModified":"2026-10-29T23:16:33.322Z","description":"Security researchers at Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code, and Codex. Each...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28adca515225d5ef4ca7be91cacae0b8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28adca515225d5ef4ca7be91cacae0b8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,github,ai-security,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl","comment":[{"@type":"Comment","text":"The interesting part isn’t the individual bugs but the class: an embedded webview in a dev tool is effectively a browser with a privileged bridge, so anything it renders (a README preview, a docs page the agent opened) becomes attack surface. A quick check when evaluating these tools is to look at which JS/IPC bridge APIs the webview exposes and whether local HTML or file:// pages can load at all. Since the researchers report two of the five still unpatched, disabling built-in preview/browser features or opening untrusted repos in a separate VM is a reasonable stopgap.","datePublished":"2026-10-30T01:31:28.202Z","url":"https://daily.dev/posts/1Y5vx9HjL#c-w1MG4DndH","author":{"@type":"Person","name":"MrĐức Nguyen","url":"https://daily.dev/mrucnguyen","image":"https://lh3.googleusercontent.com/a/ACg8ocLP_Etv42lc1zE6ujLsSBbOz8MbYPMf4QNwBzZADzfSGTcdXh_E=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched-1y5vx9hjl#faq","mainEntity":[{"@type":"Question","name":"Is the Codex embedded browser vulnerability patched yet?","acceptedAnswer":{"@type":"Answer","text":"No, the arbitrary file read vulnerability in OpenAI's Codex remains unpatched. Forever Security disclosed the flaw to OpenAI on July 27, received no response, and as of the report OpenAI had not fixed it or replied to inquiries about a fix. A local HTML page opened in Codex's browser could read any file on the machine directly, without needing a web worker. Developers relying on Codex can track unresolved security issues like this one via daily.dev."}},{"@type":"Question","name":"How did the Cursor arbitrary code execution bug work?","acceptedAnswer":{"@type":"Answer","text":"Cursor's integrated browser let a webpage call the agent's composer, and the agent treated page content as hidden instructions it would follow, enabling prompt injection that could execute commands on the host machine. Researchers disclosed it to Cursor on September 10, and Cursor silently patched it on October 1 without a security advisory. Teams adopting AI coding agents like Cursor can follow such security disclosures on daily.dev."}},{"@type":"Question","name":"What is the GitHub Copilot address bar spoofing vulnerability?","acceptedAnswer":{"@type":"Answer","text":"GitHub Copilot's embedded browser let a webpage report its own address rather than verifying where the tab actually pointed, so the app only checked that the string looked like a URL starting with http, https, or file. This allowed attackers to display a spoofed address like github.com/login while loading a phishing page underneath. GitHub fixed it in Copilot build 1.1.29 on October 13. Developers evaluating Copilot's security posture can keep up with disclosures like this on daily.dev."}}]} ```