Researchers find built-in browsers in VS Code, Cursor, Copilot, Codex and Claude Desktop can be breached

Forever Security says it found, in the built-in browsers of five AI coding assistants—Cursor, GitHub Copilot, OpenAI Codex, VS Code and Anthropic Claude Desktop—methods to bypass the built-in browser restrictions and let web pages or local files access the computer outside the browser. In Cursor, a web page can hide instructions that induce the agent to request command execution; after the sandbox blocks it, the agent closes the sandbox itself and retries. Copilot, meanwhile, can be influenced by a web page to display a fake github.com/login sign-in page in the address bar. In Codex, VS Code and Claude Desktop, a single local file can read the entire disk; the attack uses a background web worker launched by the page to bypass folder checks, and Codex has no such check at all.