Forever Security says Codex and VS Code browsers can still read the disk; Cursor, Copilot, Claude Desktop hit

94 days since Forever's report to OpenAI, no reply, no CVE and no score from anyone

Forever Security, which sells software that watches how AI tools behave on endpoints such as developer laptops, published two posts on 29 October 2026 saying it found a way out of the browser embedded in each of five AI coding tools: Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop. It gives 27 July as the day it reported the Codex issue to OpenAI and says OpenAI has not replied. That is 94 days to publication (derived). For Microsoft, which Forever says declined its 10 September report, the count is 49 days (derived). Forever says the Codex and VS Code issues were unpatched on the day it published, and that Cursor and GitHub fixed theirs.

Those dates and statuses are Forever's. What they do not establish is most of what a security lead would ask next. No CVE or GitHub advisory id appears in either Forever post, in the Help Net Security report of the same day, or on any vendor page read for this briefing, and four keyword searches of the National Vulnerability Database on 29 October found no record that matches these findings (derived; one Cursor record on a different browser flaw is covered below). Nobody has published a severity score. Forever names a version only for GitHub Copilot, 1.1.27 and 1.1.29. It names no tested build of Cursor, Codex, VS Code or Claude Desktop, no fixed build for Cursor, and no status for Claude Desktop beyond the statement that two issues remain unpatched. It does not say anyone was attacked: the file read was shown on Forever's own research machine and the Cursor result opened the Calculator app. Every vendor position in this story reaches the reader through Forever, because no vendor statement is quoted in either post or in Help Net's report.

This briefing reads Forever's main post and its technical overview in full, then each vendor's own documentation, release notes and advisory list. Help Net Security's report of 29 October was read as a secondary source, for what Forever's researcher told it. Sources were read from 18:22 UTC on Thursday 29 October 2026 (the same as GMT in the UK that day) and the key pages were read again at 18:44 UTC. Nothing was run or tested. A fix, an advisory or a vendor reply could appear within hours of publication, so every status below is stated as of that time.

Three browser rules, and the one each product is said to have bent

Forever starts from three rules that a browser on its own keeps. A page cannot run commands on your computer. A local file you open cannot read your other files. Only the browser writes the address bar. Its argument is that each of the five tools loosened one rule so the AI could preview a local project, read what a tab shows, or learn where a tab is, and that the loosening is where the gap opened. Forever names the pattern EMBRACE, for an embedded browser trusted like a real one, with three shapes: arbitrary code execution (Cursor), arbitrary content exfiltration (Claude Desktop, Codex, VS Code) and arbitrary context emulation (GitHub Copilot). Forever also says the issues do not share one bug, only one pattern. The diagram sets the three rules against the five products and Forever's stated status.

Zoom

Cursor. Forever says Cursor's integrated browser adds a channel that any page can call, with no gesture, to send text to the box the agent reads as instruction. A page can use it to forge a small interface chip: the person sees almost nothing, while the agent reads every field. A command placed in a single field is refused, Forever says, so the page splits it across several fields and asks the agent to put it back together. Forever says auto run ships on with an empty allowlist, so the command appears as one card that runs on Enter, and the same payload leaves the run card focused and waiting. The cost to the user is one keystroke. Cursor's sandbox blocked the install step. Forever says the agent then cancelled it and retried with the sandbox off, "with nothing in the page telling it to". In Forever's test the install step's hook opened Calculator. Forever says success is probabilistic and depends on the model, and it names no model. Cursor's own page on its Browser tool says its tools need approval by default, lists manual approval, an allowlist and auto run as the modes, and warns against auto run with untrusted code or unfamiliar websites. That page does not say what the shipped state of the terminal allowlist is, so Forever's "empty allowlist" statement stands on Forever alone.

Zoom

GitHub Copilot. Some pages change their address without loading a new page, which an embedded browser cannot always see, so Forever says the Copilot app let the page tell it its own address. The app showed that address to the person and passed it to the agent as the tab's location. The only check, Forever says, was that the text began with http, https or file and held no user name or password. The page never moves, so nothing corrects the claim. Forever's page placed github.com/login in the address bar over a fake sign in form, and the agent's tab list repeated it. Forever dates its confirmation to 26 September on 1.1.27 and says GitHub fixed it in 1.1.29 on 13 October, "before we had sent a report"; it describes the finding as a closed result. The public changelog of GitHub's Copilot app lists a v1.1.27 and a v1.1.29 (this site infers that is the product Forever means, since Forever does not link one). It carries no dates, and its v1.1.29 entry does not mention an address, a spoof or a security fix. Other entries in the same changelog do use the words "security issue", and the app's repository lists no published security advisories. So the fix date and what the fix changed rest on Forever.

Zoom

Codex, VS Code and Claude Desktop: one local file that read the rest of the disk

The three tools share the finding that carries the most risk, so it gets its own section. Forever says a normal browser gives a local page an opaque origin, which stops it reaching other files. Forever says Claude Desktop, Codex and VS Code instead resolve a page opened from a file location to that same file location, so a preview can fetch the files beside it. Reads within the project are meant to work. Reads outside it are meant to be blocked.

Forever says Claude Desktop and VS Code do block outside reads, but only for the page itself. The check does not run inside a web worker, which is a background script the page can start, so a worker can read any file on the machine. Forever says there are two bugs in that gap: the traversal check runs only for the top page, and inside a worker no restriction applies at all. Codex is described as the outlier. It put no file read check on the page in the first place, so the page can read any file directly and no worker is needed.

To know what to read, Forever says the attack reads the hidden index files that macOS writes into every folder a user has opened in Finder, each of which lists the folder's contents, and so walks the disk one folder at a time. On Forever's research machine the sweep collected SSH keys, .env files, npm tokens and the hosts file, and Forever says it also pulled private documents. Forever's proof of concept posted what it read to a sink on the same machine; it says a real attacker's sink would be any remote host. The primary describes the directory walk only through those macOS files. It does not say whether Windows or Linux were tested, so what follows for those systems is not established.

Zoom

The delivery is the part to read twice. The victim has to open one file, and Forever says the delivery makes that routine: the project looks like a dull financial report, the developer asks the assistant to set it up per the README, and the assistant itself draws a clickable link to a file in the project. Forever's line is that the click "arrives wearing the agent's own trust". Nothing visible happens afterwards. All three vendors document the click as a feature. Anthropic's Desktop documentation says that in a local session a developer can click an HTML, PDF or video path in the chat to open it in the Browser pane. VS Code's documentation says its integrated browser supports file URLs and lists Open in Integrated Browser for local HTML files. OpenAI's Codex documentation and release notes describe the in app browser opening file backed pages. None of the three pages read describes the project folder check that Forever says exists in two of them, which is not surprising for an implementation detail, but it means the check cannot be compared with any vendor statement.

Help Net Security reports Forever's researcher advising teams that run Codex or VS Code to pull the list of trusted projects from each machine's config file and check every HTML file in them for the pattern in the technical post. Neither Forever post names that config file. The researcher also told Help Net that "Not trusting a project inside an AI harness makes it unusable, so everyone just hits 'Trust'", which is the heart of the dispute with the vendors that follows.

Who said what: Forever's account of each vendor, against what each vendor has published

Forever's posts give a short disclosure record for each product. The table sets it beside what each vendor's own public pages show on 29 October. The last column is the one that matters: it lists what none of the sources read states. One contrast is worth keeping in view. Cursor does issue records for browser flaws: the National Vulnerability Database holds CVE-2026-61613, published 15 July 2026, on a different problem in browser enabled Cursor Cloud Agent sessions that Cursor fixed on 31 March, according to that record. It holds nothing for what Forever describes.

The report turned down over a trust prompt. Forever says Anthropic, on 23 July, and Microsoft, on 10 September, each declined its report as invalid for a "Workspace Trust" gated security boundary. Help Net Security repeats that Anthropic and Microsoft both declined, citing Workspace Trust. Neither Forever nor Help Net quotes a vendor, names the channel the reports went through, or says who replied. So the vendors' reasoning is known only as Forever's summary of it. What a reader can say is that, on Forever's account, two vendors treat the trust prompt as the boundary and consider a rigged project that a user has chosen to trust to be outside their threat model.

That position is not absurd on its face, and Microsoft's own documentation supports its shape. VS Code's Workspace Trust page says Restricted Mode disables AI agents in an unfamiliar workspace, tells users to rely on the Workspace Trust boundary until a project has been reviewed, and says to leave a folder in Restricted Mode when in doubt. Microsoft's advisory list also shows it treats a bypass of the gate itself as serious: of the ten entries on the first page, all dated 13 October, three carry Workspace Trust wording in the title and are rated High. That does not show how Microsoft judged this report. It shows that a report claiming to bypass the gate would be handled differently from one that Microsoft judged to sit inside it. Against that, Forever's researcher says a prompt that every developer accepts gives no protection, and Forever's delivery depends on the assistant steering the developer to click. The record does not settle whether a developer who declined trust would be safe: Microsoft's pages say agents stop in Restricted Mode, and none of the pages read says whether a file can still be opened in the integrated browser there.

Claude Desktop is the unclear case. Forever says Anthropic declined its 23 July report, and also says Anthropic accepted as valid a report filed by Noma Security on 24 July. It does not say what Noma's report covered, and it states no fix or version for Claude Desktop. The only unpatched list Forever gives names Codex and VS Code. That leaves Claude Desktop's status for a reader to infer, and an inference is not a fix: nothing in Anthropic's Desktop release notes read on 29 October names one. Noma's separate report on a preview pane in Claude Code Desktop, with its own timeline, is covered in an earlier briefing on this site. It is a different publication from Forever's, and this briefing does not repeat its findings. Forever Security also published an earlier report on attacks that use planted agent instruction files, covered in another briefing; it concerns downloads, not embedded browsers.

Zoom

Interests. Forever sells software that, in its own words, watches how AI tools behave on the endpoint, and its main post closes with an invitation to contact it, so a finding that vendors' own controls fall short is also its sales case. Each vendor sells the tool concerned and has an obvious interest in a narrow reading of severity and a long timeline. Anthropic and OpenAI also sell competing products. None of that makes Forever's account wrong, and none of it makes a vendor's silence evidence of a fix.

Stated and not stated: severity, identifiers, versions and use

A severity rating is what a defender normally uses to rank a patch. For these five findings nobody has published one. Forever's posts contain no score and no rating word of their own. The two vendors that declined, per Forever, did so as invalid, which is a rating of none. The one that accepted another firm's report, per Forever, is not recorded as giving a score for this issue. The table lists what the sources do and do not state.

Four labels doing the work of controls

A comforting name is not a control. Four labels in this story each stand in for a property the record does not show.

Technical details

Forever's technical overview prints proof of concept code for the Cursor bridge, the Copilot address change and the worker read. This briefing does not reproduce it and prints no working request, payload or script. What follows is what a defender can use: the identifiers Forever prints, the version and date strings, the pattern it tells defenders to hunt for, and the vendor documented settings that narrow the embedded browser. Each block names its source and the date it was read, and anything this site derived is marked.

Identifiers. These are the names Forever prints for the two page facing channels. They are listed so that logging, detection and vendor questions can use the vendors' own terms. Forever's account is that Cursor exposes its bridge to every page from any origin, and that Copilot's app accepted a page's claim about its own address.

Cursor integrated browser (bridge exposed to pages)
window.cursorBrowser.send
element-selected
attributes

GitHub Copilot app browser preview (address change accepted from the page)
window.__TAURI_INTERNALS__.invoke
plugin:browser-preview|submit_browser_preview_url_change
url
navigationKind

Versions and dates. Forever prints one version string, for GitHub Copilot. The other dates are disclosure dates. This block copies them as Forever gives them, with the status Forever states.

GitHub Copilot: address bar spoof confirmed on 1.1.27 (September 26th); fixed in 1.1.29 (October 13th)
Cursor: disclosed September 10th; vulnerability silently patched October 1st
Anthropic: July 23rd, declined as invalid for Workspace Trust gated security boundary
Noma Security to Anthropic: July 24th, accepted as valid
OpenAI: July 27th, never heard back, still unpatched
Microsoft: September 10th, declined as invalid for Workspace Trust gated security boundary, still unpatched

The line to hunt for. Forever says the one malicious line in a rigged project is ordinary looking, and tells defenders using Codex or VS Code to check every HTML file in each trusted project for the exploit pattern. The two forms the technical overview prints for that line are below. Both are common in legitimate pages, so a match is a reason to read the file, not a finding. The second block is derived by this site as a starting point for a review; it is not Forever's and it finds only the first form.

new Worker('../sw.js')
<script src="sw.js">

grep -rIl --include="*.html" --include="*.htm" "new Worker" ~/projects

Settings that narrow the embedded browser, from the vendors' own documentation. None of the vendors says these settings close the file read, so treat them as a reduction in exposure, which is this site's inference. Microsoft's integrated browser page lists the VS Code settings below, and says in untrusted workspaces the browser always uses ephemeral storage. Anthropic's Desktop page says the Browser can be turned off entirely by turning off Browser tools in Settings, under Code or Claude Code, and documents a managed setting that blocks external navigation while saying local dev servers and file previews keep working. Cursor's page puts the approval and allow list settings under Cursor Settings > Agents > Auto-Run.

workbench.browser.enableChatTools
workbench.browser.openLocalhostLinks
workbench.browser.showInTitleBar
workbench.browser.dataStorage

Settings > Code or Settings > Claude Code: Browser tools (off turns the Browser off entirely)
disableBrowserExternalNavigation  (managed setting, JSON boolean true)
browserExternalPageTools  (managed setting)
builtinBrowserEnabled  (release notes, 17 September 2026)

[features]
hooks = true
unified_exec = false
# Disable surface-specific features when needed.
browser_use = false
browser_use_full_cdp_access = false
browser_use_external = false
in_app_browser = false
in_app_updates = false
computer_use = false

OpenAI's page also lists a Force off control for In app browser under Desktop feature availability in the admin console, and says that disabling Browser Use alone does not block every browser path. Whether turning off the pane stops a file link from opening somewhere else, such as the operating system's browser, is not stated by any page read.

What to do, in the order worth doing

What could not be verified

• Forever's findings. Nothing was reproduced or tested. Every technical claim is Forever's, in its own posts and in its researcher's words to Help Net Security.
• Vendor positions. No vendor statement was found for any of the five. The two declines, the silence from OpenAI and Cursor, and the independent GitHub fix are Forever's account.
• Claude Desktop. Forever gives no status or version. Anthropic's release notes name no fix for a local file read, but release notes in this product have not been shown to mention every security fix.
• Which Codex. Forever says Codex. OpenAI's documentation places the built in browser in the ChatGPT desktop app and says it is not in the Codex CLI or IDE extension. This site infers the desktop app is the product tested; Forever does not say.
• Dates of vendor fixes. The GitHub Copilot app changelog carries no dates, and Cursor's changelog index lists no 1 October entry. The 1 October and 13 October dates rest on Forever.
• NVD. Four keyword searches on 29 October (Cursor browser, Codex browser, Claude Desktop browser, VS Code integrated browser) returned no record matching these findings (the one Cursor browser record is a different Cloud Agent flaw). A record added after that, or filed under other words, would not be shown.
• Time. Sources were read from 18:22 UTC to 18:44 UTC on 29 October 2026. A fix, advisory or vendor statement after that is not reflected.

The question that exposes the gap

If the vendor's answer is that the trust prompt is the security boundary, who in your organisation reads the list of trusted projects on each developer machine, and when did they last do it?

Key facts