Forever Security 在 Cursor、Copilot、Claude Desktop、VS…

PC본문_6월 Mouser (in Article)//

AD Manager | AD178089411676 //

// AD Manager | AD178089411676

Multiple security vulnerabilities have been discovered in five popular artificial intelligence (AI) development tools, potentially allowing hackers to execute code, steal files or manipulate browser address bars. Some flaws in tools including OpenAI’s Codex and Microsoft’s Visual Studio Code (VS Code) remain unpatched, raising concerns for users.

The Register reported on Oct. 29 local time that cybersecurity startup Forever Security had identified vulnerabilities in five AI development tools: SpaceXAI’s Cursor, GitHub Copilot, Anthropic’s Claude Desktop, VS Code and Codex.

The tools were found to grant embedded browsers capabilities and system access permissions that conventional web browsers do not allow, creating vulnerabilities that could bypass established browser security boundaries. Forever Security named this class of vulnerabilities Embrace (EMbedded BRowser).

Security vulnerabilities identified in five popular AI development tools. (Source: Forever Security)

According to Forever Security, the flaws could enable remote code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot.

JavaScript running in a conventional web browser cannot directly invoke local application functions or execute system commands. However, Cursor’s embedded browser allows web pages to invoke Composer, the working interface for Cursor’s AI agent.

The agent can interpret content delivered by a web page as instructions and execute them without separately notifying the user. If an attacker embeds malicious prompts in a web page, this could ultimately lead to a remote code execution attack, allowing arbitrary commands to run on the user’s PC through prompt injection.

Forever Security reported the vulnerability to Cursor on Sept. 10, and Cursor applied a patch on Oct. 1. However, the company reportedly did not issue an official security advisory or provide a separate response to the researchers.

GitHub Copilot’s browser preview feature also contained a flaw that allowed web pages to directly supply their own addresses to the application. The system checked only whether the supplied text followed a valid web address format, such as HTTP or HTTPS, without verifying the actual destination. As a result, an attacker could load a phishing site while displaying a legitimate-looking URL, such as github.com/login, in the address bar.

Forever Security identified the flaw on Sept. 26. GitHub independently fixed it through the v1.1.29 patch released on Oct. 13, without having received a report from Forever Security.

Attack flow of the Embrace (EMbedded BRowser) vulnerability identified by Forever Security. A local file:// page can read files in the same folder, such as ./data.json, but is blocked from accessing files outside that folder, such as /etc/hosts. Using a Web Worker bypasses this restriction, allowing the attacker to search the disk through .DS_Store files and extract SSH keys, .env files, tokens and other credentials. (Source: Forever Security)

All three tools were found to contain vulnerabilities that allowed local HTML files opened in their embedded browsers to cross security boundaries and access other files on the system.

Claude Desktop and VS Code restrict local page access to the project folder. However, researchers found that these restrictions could be bypassed using Web Workers, a browser feature that executes JavaScript in background threads separate from a web page’s main thread, allowing access to any file on the system.

Codex did not have a mechanism restricting local HTML file access to the project folder in the first place. As a result, files throughout the system could be accessed directly without using Web Workers to bypass restrictions.

Screenshot 1 from Forever Security’s demonstration of the OpenAI Codex vulnerability. A local file:// page opened in Codex’s embedded browser is assigned an actual origin, enabling access to other files on the device. (Source: Forever Security)

Screenshot 2 from the OpenAI Codex vulnerability demonstration. A local HTML page successfully accesses the ~/.ssh folder outside the project directory. The SSH private key id_ed25519 was read, while access to id_rsa failed. (Source: Forever Security)

Screenshot 3 from the OpenAI Codex vulnerability demonstration. Files collected from across the disk accumulate in the dumps/ folder, including data read from Claude’s configuration file (~/.claude/settings.json). (Source: Forever Security)

Screenshot 4 from the OpenAI Codex vulnerability demonstration. Extracted files are stored in the local dumps/ folder, with Chrome’s cookie database, browser profiles, cloud credentials and developer secrets saved as categorized JSON files. (Source: Forever Security)

Forever Security said it had reported the vulnerabilities to Anthropic, OpenAI and Microsoft, but the companies responded differently.

Anthropic initially rejected Forever Security’s Claude Desktop vulnerability report, submitted on July 23, arguing that the issue did not involve a security boundary protected by Workspace Trust. However, the following day, another cybersecurity company, Noma Security, reported the same vulnerability, prompting Anthropic to recognize it as a valid issue.

OpenAI received Forever Security’s Codex vulnerability report on July 27 but did not respond to the researchers. However, the company told The Register that it was aware of the issue and was working on a fix.

Microsoft also classified the VS Code vulnerability reported on Sept. 10 as invalid, arguing that it did not involve a security boundary protected by Workspace Trust. Workspace Trust is a security feature in VS Code that determines whether a project or folder opened by a user can be trusted and restricts the functions and permissions available within that workspace.

According to The Register, the vulnerabilities in Codex and VS Code remained unpatched at the time of publication.