Five AI Developer Tools and ChatGPT Share One Flaw: The Browser Inside Them Is Trusted More Than a Browser. Two Remain Unpatched.
Forever Security found flaws in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code and OpenAI's Codex. Per The Register, flaws in Codex and VS Code remain unpatched. All five share one weakness. Each tool built an embedded browser with more power than a normal browser has, and that broke the usual browser safety model. Separately, researchers at Parameter ran code inside ChatGPT through a shared-chat link, and OpenAI fixed it.
The five tools
Forever calls the class Embrace, for embedded browser. Per The Register:
Cursor. A page in Cursor's integrated browser can call the agent's composer, and the agent treats the input as instructions the user cannot see, so a page can run commands on the host. Forever reported it on September 10 and Cursor patched it on October 1 without an advisory or a reply.
GitHub Copilot. The app let the page report its own address, and only checked that the text looked like a web address. A phishing page could show github.com/login in the bar. Fixed in build 1.1.29 on October 13, and GitHub fixed it without receiving Forever's report.
Claude Desktop. The limits that keep local pages inside the project folder did not apply to web workers, so a local page could start a worker that reads any file. Forever reported it to Anthropic on July 23 and Anthropic rejected it as a workspace-trust matter. A day later Noma Security reported the same flaw and Anthropic accepted that report. The article does not say whether it is fixed.
OpenAI Codex. No folder restriction at all, so a local page can read any file directly. Reported July 27 with no reply; OpenAI told The Register it is aware and working to address it. Unpatched.
VS Code. The same web-worker bypass. Reported September 10; Microsoft called it an invalid workspace-trust issue. Researchers say it is unpatched.
No CVEs are mentioned in the article.
ChatGPT's shared link
Parameter reported through OpenAI's bug bounty on October 18. A shared chat could carry an interactive graph that loaded the MathLive library into the main ChatGPT page. MathLive accepted keyboard messages from any sender, and those could carry raw HTML. The Preview frame passed that HTML to the trusted main page, which built an unsandboxed frame inheriting the chatgpt.com identity, and ChatGPT's content security policy allowed a script from YouTube to run inside it. From there the code could list recent conversations and read a private chat. The victim needed no install and no sign-in; clicking Preview once was the most reliable trigger, and a later version made Preview open automatically.
OpenAI fixed it eight days after the report, rated it P1, and paid $5,000. Parameter published on October 28. The article reports no real-world exploitation, and the private-chat proof was a controlled test between separate accounts. Users have nothing to do.
What to do
Ours, not the researchers':
Update Cursor and Copilot, which have fixes. Copilot's is build 1.1.29 or later.
Treat anything an AI tool's embedded browser opens as untrusted, especially local HTML you did not write and pages from links in chats, issues or documents.
Keep secrets out of project folders. Two of the file-read flaws turn any readable file into an exposure, and a project folder is where keys and env files tend to be.
For Codex and VS Code, assume the file-read flaw is open until the vendors say otherwise, and limit what those tools can reach.
Treat a shared AI chat like a file from a stranger. The ChatGPT case needed only that someone opened a link.
What we hold, and what we don't
Nothing for the feed. These are product flaws with no network indicators published.
Limits
This rests on The Register's October 29 article and The Hacker News' October 31 summary of Parameter's research. We did not read Forever's writeup, test any tool, or confirm patch status ourselves. Statuses are as reported, and vendor responses may have changed since. One of the five is a product we use and write about, so read the Claude Desktop paragraph with that in mind.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments