Embedded browsers in VS Code, Cursor, Copilot, Codex and Claude Desktop broke out of sandbox

Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI's Codex, VS Code and Anthropic's Claude Desktop. In each case a web page or a local file reached the host machine: Cursor ran attacker code, Copilot displayed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk. Codex and VS Code had no fix as of October 29.

• Cursor patched its flaw on October 1, three weeks after Forever's report
• GitHub fixed the fake address bar in Copilot 1.1.29 on October 13
• Codex and VS Code remain unpatched, exposing SSH keys and tokens
• Anthropic and Microsoft declined the reports, citing Workspace Trust