Your coding AI can steal your keys — and two vendors haven't patched it

AI security firm Forever Security's October 29 'Embrace' report found embedded-browser flaws in five AI coding tools — Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex — that could let attackers run code on a host machine, steal files, or spoof a browser address bar.

Cursor's integrated browser let a web page call the agent's composer with instructions hidden from the user, opening a path to code execution; it was silently patched on October 1. Copilot's browser preview let a page claim its own address, so a phishing page could display github.com/login; GitHub fixed that independently on October 13. In Claude Desktop, Codex and VS Code, local HTML files could escape their project boundaries and read other files — researchers demonstrated reading SSH keys and developer tokens.

The sting is what is still open: the Codex flaw, reported to OpenAI on July 27, remains unpatched, with OpenAI saying it is aware and working on it, and the VS Code flaw, reported to Microsoft on September 10, remains unpatched according to the researchers, who say Microsoft dismissed it as a workspace-trust boundary issue.