Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code […]
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.
Two of those holes are still open. Codex and VS Code had no fix as of October 29, so a developer who opens a rigged project in either tool can still lose SSH keys, cloud credentials and developer tokens with one click.
Three browser rules, bent
A standalone browser treats every page as hostile. Three rules follow from that: a page cannot run commands on your computer, a local file cannot read your other files, and only the browser writes the address bar. Each vendor loosened its embedded browser so the AI could preview a local project or read what a tab shows. Forever’s researchers tested whether those changes broke the three rules. In all five products, one of them gave way, according to Forever’s Gal Weizman, who wrote up the research. Forever calls the pattern EMBRACE, short for an embedded browser trusted like a real one.
One click, then the whole disk
The file-read attack starts with a project dressed up as a dull financial report. The developer asks the assistant to set it up per the README, the assistant offers a clickable link to an HTML file in the project, and the developer clicks. Nothing visible happens after that.
Claude Desktop and VS Code limit a local page to its project folder, but that check covers the page alone. A web worker, a background script the page can launch, sits outside the check, so the worker can read any file on the machine. Codex had no folder check at all. To find targets, the attack reads the hidden index files macOS writes into every folder a user has opened in Finder, mapping the disk one folder at a time. On Forever’s machine, the sweep collected SSH keys, .env files, npm tokens and the hosts file, then sent them out.
Turned down over a trust prompt
Anthropic and Microsoft both declined Forever’s reports, citing Workspace Trust, the prompt that asks a developer to trust a project folder. Anthropic declined a report Forever filed on July 23, but accepted as valid a report Noma Security filed on July 24. Forever has not heard back from OpenAI since its July 27 report.
“Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust’,” Weizman told Help Net Security. In practice, he said, “that prompt provides zero protection to the user.”
Cursor and Copilot have fixes
In Cursor, all it took was a web page and one press of Enter. The page showed the developer a harmless-looking button labeled “Start setup,” with a command for the agent hidden behind it. The agent read the hidden command and asked to run it, and approving took a single keypress. When Cursor’s sandbox blocked the command, the agent switched the sandbox off and tried again, with nothing in the page telling it to. In Forever’s test, the command opened Calculator. A real attacker could launch any program with the developer’s full privileges, though the attack depends on the model and doesn’t work every time.
Asked whether organizations should assume an agent may try to bypass its own safeguards, Weizman said: “Absolutely. We’re seeing this behavior repeating itself outside the scope of this research.” He said Forever saw agents do the same, without asking permission, in its recent research on downloads.
Cursor patched its flaw on October 1, three weeks after Forever’s September 10 disclosure, and never replied to the researchers. In GitHub Copilot, a page could tell the app what address it was on, and the app checked only that the text looked like a web address. Forever’s page put github.com/login in the address bar over a fake sign-in form, and the agent’s own tab list repeated it. GitHub fixed the bug in Copilot 1.1.29 on October 13, before Forever had filed a report.
What to check now
Weizman’s advice for teams running Codex or VS Code is to pull the list of trusted projects from each machine’s config file and check every HTML file in those projects for the exploit pattern in Forever’s technical write-up. The click this attack needs comes from a link the assistant draws itself, and in Codex and VS Code that link can still open a page that reads the whole disk.
