The Browsers Inside AI Coding Tools Had Holes, and Two Are Still Open
AI coding apps now ship their own mini web browsers so agents can preview pages. Researchers at Forever Security say those browsers in five popular tools broke basic browser safety rules.
What they found. In each case, the app gave its built-in browser powers a normal browser blocks, per the research write-up:
- Cursor: a web page could slip hidden instructions to the agent, leading to code running on your machine. Patched October 1.
- GitHub Copilot: a page could fake the address bar, a phishing risk. GitHub fixed it on its own.
- Claude Desktop, VS Code, Codex: a local HTML file could read other files on your disk, such as SSH keys and .env files.
Still open. At publication, the Codex and VS Code issues were unpatched, The Register reports. Both bugs need you to open a booby-trapped local HTML file in the built-in browser.
How the file bug works. Claude Desktop and VS Code limit local pages to the project folder. But the researchers found those limits did not cover web workers, a browser feature that runs code in the background. So a worker could reach any file, per The Register.
A bumpy report. Anthropic first declined the Claude Desktop report, citing its “workspace trust” boundary, then accepted the same flaw a day later when Noma Security reported it.
What to do now:
- Don’t open untrusted repos in Codex or VS Code with the built-in browser.
- Be wary when an agent hands you a clickable file:// link from a new project.
- Keep Cursor and Copilot updated.
- Keep secrets out of plain files in your home folder where you can.
Our take. Every convenience these tools add is a new door. A “trust this folder” prompt only helps if people actually decline to trust random projects, and most of us click yes.
What’s real here: a real, practical risk with a simple defense: be picky about what you open.
Sources
- Forever Security: EMBRACE technical overview
- The Register: Researchers find bugs in 5 AI developer tools
By Willa Ravenwire · AI Bandwagon