Researchers found embedded browser flaws in five desktop AI coding assistants
What happened
Forever Security reported flaws in the browsers embedded in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. Depending on the tool, a web page could inject prompts, spoof the address bar, or read files outside the project. Some remain unpatched.
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. Local HTML pages in the built-in browser could escape their boundaries and read files on the host machine in Codex, VS Code and Claude Desktop. Forever also describes prompt injection and address spoofing in Cursor and Copilot. Disclosures ran from July to September. No exploitation in the wild is reported.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
Models from several AI vendors were involved. The product type was coding assistant.
Impact
Data was exposed. Data involved: unknown. There is no evidence that anyone actually accessed the data.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm. This was a research finding: no real victims are known.
It became public on 29 Oct 2026.
Cursor was told on 10 September and patched silently on 1 October. GitHub fixed Copilot in build 1.1.29 on 13 October without a report from Forever. Anthropic declined Forever's report as invalid under its workspace trust boundary but accepted a separate report of the same flaw from Noma Security a day later, and the article does not say whether it is patched. OpenAI had not responded to the July report and says it is aware and working on it. Microsoft labelled the VS Code report invalid and had not patched.