Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched

What happened: Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and OpenAI's Codex. Why it matters: Forever calls the class "Embrace," saying each tool enriched its embedded browser beyond normal browser limits, undermining the traditional threat model. The flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in Copilot.

Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and OpenAI's Codex.

Forever calls the class "Embrace," saying each tool enriched its embedded browser beyond normal browser limits, undermining the traditional threat model. The flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in Copilot.