Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop

Fo­re­ver Se­cu­rity found ways out of the built-in brow­sers in five AI co­ding as­sis­tants: Cur­sor, GitHub Co­pi­lot, Ope­nAI’s Codex, Mi­cro­soft’s VS Code and Anth­ro­pic’s Clau­de Desk­top. In all five, a web page or a local file reached the com­pu­ter behind the brow­ser. Cur­sor ran at­tac­ker code, Co­pi­lot sho­wed a fake ad­dress, and Codex, VS Code and Clau­de Desk­top let a sin­gle local file read the rest of the disk. Two of those holes are still … More → The post Re­sear­chers broke the brow­sers built into VS Code, Cur­sor, Co­pi­lot, Codex and Clau­de Desk­top ap­pea­red first on Help Net Se­cu­rity .