{
  "id": 17145957,
  "title": "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched",
  "url": "https://urgent.news/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-29T23:12:26.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508"
  },
  "original_language": "en",
  "account": "Researchers have uncovered five vulnerabilities across popular AI developer tools, with two open issues from OpenAI and Microsoft yet to be patched. Forever Security identified these flaws in Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and Codex. The common issue lies in the tools' embedded browsers, which have been granted excessive capabilities, leading to a class of vulnerability known as \"Embrace\". This flaw allows attackers to execute code, access and steal files, or manipulate browser address bars. Cursor's vulnerability enables arbitrary code execution, while GitHub Copilot's issue involves address bar spoofing. Claude Desktop, Codex, and VS Code all permit local pages to read arbitrary files. The security researchers disclosed these issues to the respective vendors, but three out of five have not responded, leaving developers potentially at risk.",
  "summary": "Embedded browsers are at the heart of the problem",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}