Embedded Browser Flaws in VS Code, Cursor, Copilot, Codex, and Claude Desktop Expose Developer Credentials
What Happened — Researchers at Forever Security discovered that the built‑in browsers used by five AI‑powered coding assistants (Microsoft VS Code, Cursor, GitHub Copilot, OpenAI Codex, and Anthropic Claude Desktop) violate three fundamental isolation rules that a normal browser enforces. In each product, a maliciously crafted web page or local file can escape the sandbox, execute code on the host, or read arbitrary files on the disk. The attack chain starts when a developer opens a project that contains a specially crafted HTML file; clicking the link triggers a background script that reads the entire file system, harvesting SSH keys, .env files, npm tokens, and the hosts file. Two of the flaws (in Codex and VS Code) remain unpatched as of 29 Oct 2026, leaving developers who trust a project exposed to credential theft with a single click.
Why It Matters for Trust & Control Assurance — The findings highlight a control gap in the “secure configuration and isolation of embedded components” objective, underscoring the need for continuous evidence that third‑party development tools enforce proper sandboxing.
Who Is Affected — Software developers, DevOps teams, and organizations that rely on AI coding assistants across technology, SaaS, and cloud‑native environments.
Recommended Actions
- Inventory all AI‑assisted development tools and verify they are running the latest patched versions.
- Enforce a policy that any embedded browser must enforce the three isolation rules (no command execution, no unrestricted file reads, address‑bar integrity).
- Deploy monitoring that logs file‑system access originating from IDE extensions or embedded browsers.
- Require developers to validate trust prompts through a documented approval workflow rather than a single click.
- Collect and map evidence of these controls to your audit framework of record.
Technical Notes
- Attack vector: Exploitation of embedded‑browser sandbox bypass (misconfiguration/logic flaw).
- Affected products: VS Code, Cursor, GitHub Copilot, OpenAI Codex, Anthropic Claude Desktop.
- Impact: Potential exfiltration of SSH keys, cloud credentials, developer tokens, and other sensitive files.
- Status: Fixes released for Cursor and Copilot; Codex and VS Code remain vulnerable.