> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Unpatched flaws in VS Code and Codex allow file theft via embedded browsers
- URL: https://f4n6.co.uk/security-feed/unpatched-flaws-in-vs-code-and-codex-allow-file-theft-via-embedded-browsers/
- Published: 2026-10-30T09:44:18.000Z
- Updated: 2026-10-30T09:44:18.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Forever Security has published five vulnerabilities in AI developer tools (Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code, OpenAI Codex) that share one weakness: each tool's embedded browser was given capabilities a normal browser does not have, and those capabilities break the browser's usual trust boundary. The flaws allow arbitrary code execution in Cursor, arbitrary file read in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot. Cursor and GitHub Copilot have fixes; the Codex and VS Code file-read flaws are reported as still unpatched, and no CVE has been assigned to any of the five. No CVSS score, EPSS estimate or CISA KEV entry exists for these issues, so severity cannot be stated on a standard scale; the exposure is to developer workstations and the source code, credentials and cloud access they hold. For EMEA financial services the risk sits with engineering teams running these assistants against production-adjacent repositories, where a single developer workstation is a route into source control and CI.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                                                     | Practical impact                                                                                                                                                                               |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles | Two of the five affected tools (VS Code, Codex) remain unpatched by their vendors, and a third (Cursor) fixed its flaw silently without a security advisory                                         | Firms using these tools as ICT third-party dependencies need a documented position on running a vendor component with a known, unfixed file-read flaw, and a route to escalate with the vendor |
| NIS2 Art. 21(2)(d): supply chain security measures     | The flaws are reachable through content a developer opens in the tool (a local HTML page, a web page loaded in the embedded browser), so the tool's own trust boundary is the supply chain exposure | Entities in scope should treat AI coding assistants as supply chain components and record the security posture of each version in use                                                          |

## 3\. Technical analysis & attack chain

The five flaws are one class. Forever calls it "Embrace" (EMbedded BRowser). Each vendor extended its embedded browser past normal browser behaviour in one of three ways: treating page content as agent input, letting the page declare its own address, or giving the embedded browser reach onto the host filesystem. The attack chain below is the Cursor code-execution path, which is the most fully described.

1. A user opens a web page in Cursor's integrated browser.
2. JavaScript on that page calls the agent's composer directly. A normal web page cannot talk to local applications; Cursor's embedded browser permits the call.
3. The agent reads the call as instructions and acts on them. The instructions are not shown to the human user, so the user sees no prompt to approve.
4. The agent executes commands on the host machine under the user's account.

That is prompt injection with a host-execution outcome. The page does not need to exploit a memory corruption bug; it needs the agent to accept its text as a task.

**GitHub Copilot, address bar spoofing.** Copilot's browser preview let a page report its own address. The app checked only that the string began with `http`, `https` or `file`, not where the tab actually pointed. A page can therefore display `github.com/login` in the address bar while a phishing page loads underneath. Forever found this in Copilot 1.1.27 on 26 September 2026; GitHub fixed it in 1.1.29 on 13 October 2026 without receiving a report from Forever.

**Claude Desktop, VS Code and Codex, arbitrary file read.** All three let a local HTML file opened in the built-in browser read files outside its boundary. Claude Desktop and VS Code restrict local pages to the project folder, but the restriction did not apply to web workers, the browser feature that runs JavaScript on a background thread. A local page starts a worker and the worker reads any file on the machine. Codex had no such restriction at all: a local page reads any file directly, no worker needed. The practical consequence is that a malicious HTML file delivered by any route (a cloned repository, a download, an attachment) can exfiltrate SSH keys, cloud credentials, `.env` files and source outside the open project.

**Patch and disclosure status.** Cursor patched its code-execution flaw on 1 October 2026, silently, with no advisory and no response to Forever. GitHub fixed Copilot independently. Anthropic declined Forever's Claude Desktop report as invalid on a "workspace trust" gated boundary, then accepted the same flaw from Noma Security a day later. Microsoft labelled the VS Code issue an invalid workspace trust gated boundary issue on 10 September 2026 and Forever says it remains unpatched. OpenAI received the Codex report on 27 July 2026, did not respond, and Forever says it remains unpatched.

**Confidence.** The technical descriptions and the disclosure timeline rest on Forever Security's report as relayed by The Register; this is single-sourced. The Register states it sought comment from Cursor, GitHub, Anthropic, OpenAI and Microsoft and that none responded (GitHub and the others did not reply), so the vendor-side account of each flaw is not corroborated here. No exploitation in the wild is reported by any source. No CVE identifiers, CVSS scores, EPSS values or CISA KEV entries exist for these five issues. Related research in the same period covers adjacent weaknesses in the same tools: Wiz's "GhostApproval" symlink bypass across six coding agents (July 2026), Manifold Security's eight flaws in seven command-line agents via malicious `.git` configuration (September 2026), and sandbox escapes in Cursor, Codex, Gemini CLI and Antigravity reported by BleepingComputer. Those are separate findings with their own identifiers and should not be conflated with the five Embrace flaws.

## 4\. Mitigation & containment

### P1, within 24 hours

- Inventory which of the five tools are installed and at what version. For GitHub Copilot, confirm the build is 1.1.29 or later; anything at 1.1.27 or earlier is exposed to address bar spoofing and should be updated now.
- For Cursor, confirm the build postdates the 1 October 2026 silent fix. Because Cursor published no advisory, the only reliable check is the installed version against the vendor's release history; where that cannot be established, treat the install as unpatched.
- For VS Code and Codex, which Forever reports as unpatched, disable or restrict the embedded browser and the opening of local HTML files in the assistant. Where the tool cannot be configured to refuse local HTML, block it at the endpoint.
- Tell developers not to open untrusted HTML files or untrusted web pages inside these assistants' embedded browsers, and not to run the agent against repositories of unknown provenance.

### P2, within 72 hours

- Restrict what the agent can reach on disk. Run these tools under an account whose home directory holds no SSH private keys, cloud credential files or production secrets, and keep credentials in a separate vault the agent process cannot read.
- Apply endpoint detection for the behaviour in §6: an AI assistant process spawning a shell or reading files outside the open project.
- For Copilot users, treat any address bar shown inside the browser preview as untrusted for authentication decisions until 1.1.29 is confirmed deployed everywhere.

### P3, within 7 days

- Raise the unpatched VS Code and Codex flaws with Microsoft and OpenAI through existing support or account channels and record the response, or its absence, against the DORA Art. 28 third-party file.
- Review whether any developer workstation running these tools also holds standing access to production CI, package registries or cloud control planes, and remove that standing access in favour of short-lived credentials.
- Re-test after each vendor release; the Cursor and Copilot fixes show the vendors are shipping changes without advisories, so version pinning alone will not tell you when a fix lands.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources give no hashes, domains, IP addresses, file paths or command lines. The flaws are reached through content the user opens, not through a fixed attacker infrastructure, so there is nothing atomic to pivot on.

Behavioural indicators:

| Behaviour                                                                                                                                                                    | Where to observe                                      | Confidence                                   |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | -------------------------------------------- |
| AI assistant process (Cursor, Codex, Claude Desktop, VS Code) spawns a shell or executes a command shortly after a page or local HTML file is opened in its embedded browser | Endpoint process telemetry, parent-child process tree | Medium; described by Forever, single-sourced |
| Assistant process reads files outside the open project folder, particularly \~/.ssh, cloud credential files or .env                                                          | File access auditing, EDR file-read events            | Medium; described by Forever, single-sourced |
| A web worker started from a local HTML page reads files beyond the project folder (Claude Desktop, VS Code)                                                                  | Browser/embedded-browser process telemetry            | Medium; described by Forever, single-sourced |
| Copilot browser preview shows a URL whose host does not match the content rendered (for example a login page for a different domain)                                         | User reports, browser preview telemetry               | Medium; described by Forever, single-sourced |

## 6\. Detection

The sources give no file artefacts, command-line flags, mutexes or hard-coded values for these flaws, so a YARA rule built on them would only match reporting about the issue. There is a usable behavioural signal for Sigma: an AI coding assistant process spawning a shell. The process names below are the products named in the source; the rule keys on the assistant spawning a command interpreter, which is the Cursor code-execution pattern.

```yaml
title: AI coding assistant spawns a command interpreter
id: 8f2c1a44-embr-4c1e-9a10-000000000001
status: experimental
description: Detects an AI coding assistant process spawning a shell, consistent with the Cursor embedded-browser prompt-injection code execution described by Forever Security.
author: Adverse Trace
date: 2026-10-30
references:

  - https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:

      - '\Cursor.exe'
      - '\Code.exe'
      - '\claude.exe'
      - '\codex.exe'
  selection_child:
    Image|endswith:

      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\wsl.exe'
  condition: selection_parent and selection_child
falsepositives:

  - Developer legitimately asking the agent to run a build or shell command
level: medium

```

Tune the parent image names to the exact binaries in your estate before enabling; the source names the products but not their executable filenames, so confirm each against the installed build. On macOS and Linux, port the rule to the equivalent process-creation telemetry with the same parent/child logic.

## 7\. Sources

- The Register, "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched", https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508, 2026-10-29
- BleepingComputer, "Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes", https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
- The Hacker News, "Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code", https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
- The Register, "Bug in top AI coding agents shows that Unix-era security headaches never really die", https://www.theregister.com/security/2026/07/08/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die/5268025, 2026-07-08
- The Register, "Devs to Anthropic, OpenAI, Cursor, and friends: Make security and privacy the default", https://www.theregister.com/ai-and-ml/2026/08/08/devs-to-anthropic-openai-cursor-and-friends-make-security-and-privacy-the-default/5285107, 2026-08-08

## 8\. Adverse Trace position

No CVSS score, EPSS estimate or CISA KEV entry exists for these five flaws, so we do not assign a severity band; the exposure is real but unquantified on standard scales, and the technical account is single-sourced to Forever Security via The Register with no vendor confirmation. Our assessment is that the file-read flaws in VS Code and Codex matter most to clients because they remain unpatched and because developer workstations hold credentials that reach source control and cloud environments; the Cursor code-execution flaw is fixed but was fixed silently, which means version checks, not advisories, are how you confirm exposure. We will track vendor releases for VS Code and Codex and update this advisory if a CVE, patch or exploitation report appears, and we recommend clients confirm their Copilot build is 1.1.29 or later and establish whether their Cursor install postdates the 1 October fix before the end of the week.

---

[Read the original source →](https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*