{
  "id": 17146704,
  "title": "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched",
  "url": "https://urgent.news/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-17146704",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-29T23:12:26.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508"
  },
  "original_language": "en",
  "account": "AI security researchers have discovered flaws in five popular AI developer tools that could let attackers execute code on host machines, read and steal files, or spoof browser address bars. OpenAI's Codex and Microsoft's VS Code, in particular, have unpatched vulnerabilities that pose a risk to developers. Forever Security, the researchers, found issues in Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and Codex, and notified the respective vendors. GitHub independently addressed the Copilot vulnerability without needing a report from Forever Security. The common issue among all five tools is that their embedded browsers have been given capabilities beyond those of conventional browsers, creating a security weakness. The researchers dubbed this flaw \"Embrace,\" short for EMbedded BRowser. Specifically, Cursor allows arbitrary code execution, GitHub Copilot enables address bar spoofing, Claude Desktop, Codex, and VS Code all permit arbitrary file reading, and GitHub Copilot can spoof browser address bars.",
  "summary": "Embedded browsers are at the heart of the problem",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}