Vulnerabilities have been found in two popular developer tools, OpenAI Codex and Microsoft VS Code, that could allow attackers to access files on a user's computer. Potential targets include program code, passwords, and server access keys. The companies reported the issues months ago, but as of October 29, they had not been fixed.
Vulnerabilities have been found in two popular developer tools, OpenAI Codex and Microsoft VS Code, that could allow attackers to access files on a user's computer. Potential targets include program code, passwords, and server access keys. The companies reported the issues months ago, but as of October 29, they had not been fixed.
This is reported by The Register, citing specialists from Forever Security, who investigated the security of Cursor, GitHub Copilot, Claude Desktop, Codex, and VS Code.
The problem "hides" in the browsers built into Codex and VS Code. They allow you to view web pages and open files directly in the programming tool. Typically, the browser does not allow the opened page to read third-party files on your computer. But researchers have found that this protection can be bypassed in Codex and VS Code.
To carry out the attack, a developer needs to open a specially crafted HTML file in the built-in browser. The code hidden within it can then access other files on the computer.
In addition, in Codex, a malicious page could immediately read files on the computer, even if they were not related to the project the developer was working on. In VS Code, access to third-party files was restricted. However, the researchers found a workaround: if the page ran code in the background, these restrictions no longer applied. Thus, attackers could also get to the files that the program was supposed to protect.
Forever Security notified OpenAI of the Codex issue on July 27. The researchers say they have yet to receive a response. But an OpenAI spokesperson confirmed to The Register that the company is aware of the vulnerability and is working to fix it.
Microsoft received a report of the issue in VS Code on September 10. But, according to the researchers, the company dismissed the report, citing that the issue concerns a work environment that the user has already trusted.
In total, Forever Security tested five popular tools: Codex, VS Code, Cursor, GitHub Copilot, and Claude Desktop. Each one found issues related to built-in browsers. But the other three tools had their issues fixed.
The researchers have dubbed this class of vulnerabilities EMBRACE. They warn that the problem could also affect other AI tools that give embedded browsers more capabilities than regular browsers.
Until OpenAI and Microsoft patch the vulnerabilities, developers should be more careful with the files they open in Codex and VS Code. First of all, you should not open suspicious HTML files in the built-in browsers of these tools. Especially if they come from unfamiliar projects or repositories.
It is also worth checking the files that the AI assistant itself suggests opening, as it may not recognize the danger and advise the user to open a malicious page.
Also, to work with unfamiliar projects in VS Code, you can use Restricted Mode, a mode that limits code execution and the work of AI agents until the user checks the files.
Previously, dev.ua wrote that Forever Security researchers discovered another way to attack AI programming assistants. A malicious file in the "Downloads" folder could force Codex to install a virus on the developer's computer.
