Security vulnerabilities exposed in embedded browsers of five AI coding tools

Security researchers at cybersecurity firm Forever Security published details about vulnerabilities discovered inside the mini-browsers built into major AI coding assistants. Tools like Cursor, GitHub Copilot, Claude Desktop, VS Code, and OpenAI Codex embed web browsers so their assistants can inspect websites and render local previews. However, modifying standard browser permissions to accommodate AI agents created pathways for malicious websites or local files to compromise the user's machine.

By tweaking traditional web safety protocols to grant AI assistants extra capabilities, developers accidentally enabled untrusted pages to manipulate the software. Attackers could trick the AI into running host system commands, stealing local documents, or spoofing web addresses. In one demonstrated exploit, a hidden prompt on a web page convinced Cursor's assistant to manually disable its own safety sandbox. Cursor and GitHub Copilot have since addressed these vulnerabilities, but tools like Microsoft's VS Code and OpenAI's Codex were still unpatched when the findings were made public.

This trend highlights how rapidly deploying autonomous AI agents can erode established software security boundaries. It remains unclear how tech vendors will consistently prevent AI helpers from being manipulated by hidden web text without severely restricting what the agents can accomplish. Until foundational protections built specifically for autonomous agents are established, embedding legacy tools into AI software will continue to expose users to unexpected computer takeovers.