Forever Security reports embedded-browser weaknesses in Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code, with different impacts including host execution, address spoofing and local-file access. The researchers describe controlled demonstrations and product-specific fixes or unresolved reports; their account does not establish exploitation against users.
Why it matters
It identifies the embedded browser and its application bridges as additional trust boundaries in agent products.
Key facts
As stated in the sources, with where to find them.
- The researcher reports Cursor fixed on October 1 and Copilot fixed in version 1.1.29 on October 13. At publication it described Codex and VS Code as unresolved; Claude Desktop remediation was not established.Technical companion, product Resolution sections
- The Cursor demonstration depended on agent behavior and a user keystroke. The local-file demonstrations required opening local content; the report does not show every ordinary remote page can read a host filesystem.Technical companion, Cursor Impact; Local File Read, Delivery
- Patch states and disclosure responses are the researcher’s account as of October 29, not independent vendor confirmations or proof that all versions share the same exposure.Disclosure; technical companion, Resolution sections
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
Sources
Related records
Oct 13, 2026
Sep 30, 2026
May 7, 2026
Aug 6, 2025
Aug 1, 2025
Aug 4, 2026