Researchers warn of flaws in five AI coding tools
The reported vulnerabilities could expose files or enable code execution, while researchers said flaws in OpenAI Codex and Microsoft VS Code remained unpatched when their research was published.
Security researchers have reported vulnerabilities in five AI-assisted developer tools that use embedded browsers. They say the flaws could allow malicious pages or prompts to read local files, run commands or mislead users about the websites they are viewing.
The tools named in the research are Cursor, GitHub Copilot, Anthropic’s Claude Desktop, Microsoft’s Visual Studio Code and OpenAI’s Codex. The researchers said the products gave embedded browsers permissions beyond those normally available to a conventional browser.
The reported weakness centres on the boundary between a webpage and the local computer. In some configurations, a malicious page could manipulate the coding agent into treating hidden instructions as legitimate tasks. Other demonstrations involved reading local files or spoofing the address shown by an embedded browser.
The researchers said Cursor had patched its reported issue on 1 October and GitHub had fixed the Copilot problem in a later build. They said the issues affecting Codex and VS Code remained unpatched when the research was published on 29 October. The Register reported that vendors were contacted for comment.
The findings concern particular configurations and tool versions, rather than every use of the products. The researchers’ demonstrations also do not establish that a large-scale attack has occurred. The researchers’ findings highlight risks associated with giving coding agents access to local files and command tools.
Developers increasingly use AI tools inside editors and development environments, where they may have access to source code, credentials and deployment systems. Security decisions therefore depend not only on the model but also on the permissions granted by the surrounding application.
Vendors may issue fixes or change their positions after publication. Users should consult the relevant security advisories and avoid giving development tools more access than their work requires while the reports are assessed.
Also show the region and a close-up
One story, several perspectives
What is established
- Researchers reported vulnerabilities in five AI coding tools.
- The reported issues involve embedded-browser permissions and agent behaviour.
- Patch status differed between vendors at the time of publication.
Left
Arguments AI tools with access to code and credentials should be regulated as high-risk software, with mandatory disclosure, rapid patching and clear liability for vendors.
Values Worker protection, accountability and security by design.
Consequences Stronger obligations could reduce harm but increase compliance costs and slow releases.
Centre
Arguments The immediate priority is transparent testing, clear user warnings and least-privilege defaults. Rules should target measurable security failures rather than AI branding alone.
Values Evidence, proportionality and practical risk reduction.
Consequences A standards-based approach could improve safety while preserving useful developer tools.
Right
Arguments Professional developers and organisations should manage permissions and choose tools responsibly. Heavy regulation could entrench large vendors and limit competition.
Values User responsibility, innovation and open competition.
Consequences Flexible markets may improve products faster but leave less sophisticated users at greater risk.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article accurately attributes the technical findings to security researchers and The Register. It avoids claiming that exploitation has occurred at scale or that every installation is vulnerable.
- confirmed Five named AI developer tools were included in the research. — The Register report lists the five tools. source
- confirmed The reported flaws could enable code execution, file theft or address-bar spoofing. — Technical findings described by the researchers and summarised by The Register. source
- confirmed Codex and VS Code were reported as unpatched at publication. — The Register and secondary incident record. source
Editor's note
The existence of the reported research and vendor patch status at publication are supported. The practical risk depends on versions, settings and whether an attacker can induce the relevant interaction.Sources
- Researchers find bugs in 5 AI developer tools — The Register
- Embedded-browser flaws found in five AI coding tools — The Agentic Times
More on this in other media
- Channel 4 News — „artificial intelligence”
- BBC News — „artificial intelligence”
- The Guardian — „artificial intelligence”