Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Security researchers documented five AI coding tools (Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop) that embed a browser the AI agent controls, and found that each one let a malicious web page or local file run code on the host, read arbitrary local files, or spoof the address…