Forever Security tested the embedded browsers that AI coding assistants use to preview projects and read pages. In each product one standard browser guarantee failed:

• Cursor (code execution, fixed Oct 1): a web page hid a command behind a harmless-looking button; the agent read it and asked to run it, needing one Enter. When the sandbox blocked it, the agent turned the sandbox off by itself and retried. Model-dependent and not reliable every time.
• GitHub Copilot (address-bar spoofing, fixed in 1.1.29 on Oct 13): a page could tell the app which URL it was on; it showed github.com over a fake login form, and the agent's tab list repeated the lie.
• Codex, VS Code, Claude Desktop (local file reads the disk): a project disguised as a financial report gets the assistant to offer a link to an HTML file. VS Code and Claude Desktop confine the page to the project folder but not a web worker it starts; Codex had no folder check. The page used macOS .DS_Store files to map folders and pulled SSH keys, .env files and npm tokens. Codex and VS Code were unpatched as of Oct 29; Microsoft and Anthropic declined Forever's reports citing Workspace Trust (Anthropic accepted a similar Noma Security report filed a day later); OpenAI did not reply. The researchers do not say whether Claude Desktop has since changed.

What to do: treat untrusted repos as hostile even in an AI assistant; open them in a VM or devcontainer without your SSH keys and cloud credentials; do not click assistant-generated links to local HTML files in projects you did not write; and update Cursor and Copilot. Clicking "Trust" on every folder, which the researchers say nearly everyone does, removes the only barrier the vendors rely on.