Forever Security flags browser-escape and local-file risks in five AI assistants

Key points

• Forever Security reviewed Claude Desktop, Cursor, GitHub Copilot, OpenAI Codex, and Microsoft's VS Code.
• Findings include leaving embedded browser context, hostile code execution, address-bar spoofing, and local file reads.
• No CVE identifiers were issued; severity guidance is informational rather than a formal vendor rating.
• K-12 administrators should treat AI assistants as high-trust software and limit local file and browser capabilities.

On October 29, 2026, Forever Security published findings from a review of five assistant products used for coding and desktop work: Microsoft's VS Code, GitHub Copilot, Cursor, OpenAI Codex, and Anthropic's Claude Desktop. The research describes several ways the tools' embedded browsing components could be left behind, allowing hostile code to run outside the expected context. The same review reports that a misleading address could be shown to users and that local files could be reached through file-access paths.

No CVE identifiers were attached to the findings, and the severity hint provided with the research is informational rather than a formal vendor rating. That does not make the issues harmless. An assistant that can both browse and read local content sits close to sensitive data, including student records, internal documents, and administrative sessions. If an attacker can influence what the assistant loads or displays, the assistant becomes a bridge between untrusted web content and the endpoint.

The affected products are widely used by developers and IT staff, but K-12 agencies also deploy AI helpers for drafting, summarization, and coding support. The risk is greatest where extensions run with the user's own permissions and where browser previews are trusted as ordinary web pages. A spoofed address bar can train users to trust a hostile page, while local file access can expose material the assistant was never meant to index or transmit.

Because no CVE was assigned, patch tracking and vulnerability scanners may not flag these products. Administrators should ask vendors for status updates and rely on configuration controls rather than waiting for a scanner signature. The finding also reinforces a broader lesson: AI assistants are not neutral text boxes. They combine network access, local file permissions, and code execution in one process.

Watch for vendor advisories, extension updates, and changes to browser sandboxing or file-permission prompts. Until then, limit which AI tools can open local folders or render web content, and log unusual assistant behavior. The October 29 disclosure is a prompt to review trust boundaries, not a reason to ban every assistant outright.

What to do now

1. Inventory all installations and extensions for VS Code, Cursor, GitHub Copilot, OpenAI Codex, and Claude Desktop, recording versions and owners.
2. Restrict AI assistants from opening sensitive local folders, and run them under least-privilege accounts or separate test profiles.
3. Disable or limit embedded browser previews and web content rendering where policy allows, and require allowlisting for external sites.
4. Ask each vendor for an advisory or status update, then patch promptly; do not wait for CVE-based scanners to flag these products.
5. Add endpoint logging and EDR alerts for assistant processes that spawn shells, read sensitive paths, or make unexpected network connections.
6. Train staff not to trust embedded address bars for sensitive logins, and direct them to a standard browser for high-risk sites.
7. Review data classification and DLP rules for content reachable by AI tools, especially student records and administrative documents.

Original source

Help Net Security