The Register reported on 29 October that AI security startup Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Anthropic’s Claude Desktop, Microsoft’s VS Code and OpenAI’s Codex. The researchers say the flaws in Codex and VS Code remain unpatched.
By our arithmetic from the disclosure dates in the report, the Codex flaw had gone 94 days from disclosure to OpenAI on 27 July to The Register’s 29 October report, and the VS Code flaw 49 days from disclosure to Microsoft on 10 September. Cursor’s fix came 21 days after disclosure.
Business Pill · Least Privilege
A short explainer on least privilege: giving software only the access it needs. It is a general explainer and is not about this story.
The key insight: The Register reports that Forever Security found embedded-browser flaws in five AI coding tools and says the Codex and VS Code flaws remain unpatched; by our arithmetic, the Codex flaw had gone 94 days from disclosure to the 29 October report.
According to the report, all five tools share one weakness: “embedded browsers granted capabilities beyond those available to conventional browsers”. Forever researcher Gal Weizman wrote that each tool “enriched its embedded browser beyond what a normal browser allows”.
Forever named the class “Embrace”, short for EMbedded BRowser. The report says the flaws led to “code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot”.
Days from disclosure to a fix, or to The Register’s 29 October 2026 report where the researchers say no patch exists: Codex 94 days, VS Code 49, Cursor 21 to patch, Copilot fixed 17 days after discovery. Our arithmetic from the dates in the report; unpatched status is the researchers’ claim.
Who Fixed What, and When
The report says Forever disclosed the Cursor flaw on September 10 and the vendor silently patched it on October 1, without publishing a security advisory. GitHub independently fixed the Copilot flaw in build 1.1.29 on October 13, without receiving a report from Forever.
Anthropic first declined the Claude Desktop report, filed on July 23, as invalid, according to Weizman; a day later Noma Security reported the same flaw and Anthropic accepted it as valid. The report does not say whether Claude Desktop has been patched.
Forever disclosed the Codex bug to OpenAI on July 27 and did not get a response. An OpenAI spokesperson told The Register that the company is aware of the issue and working to address it. Microsoft labelled the VS Code report invalid, the researchers say, and they claim it remains unpatched.
The Business Lever: The Agent’s Browser Is the New Perimeter
As we read the report, the common thread is that coding agents give their built-in browsers more reach than a normal browser has, so a web page or local file can become an input to the agent or a path onto the developer’s machine. As we read it, that makes each vendor’s patch status part of the decision for companies rolling out these tools.
It follows the same thread as our recent coverage: our tampered add-on piece covered a compromised Claude Code extension, and our stolen key piece covered a breach that ran up 1.7 million Claude calls. Our Revolut piece covered how widely these coding tools are now deployed inside companies.
The Structural Read
As we read the report, the five flaws share one design choice: each tool gave its built-in browser more reach than a normal browser has.
By our arithmetic from the report’s dates, Cursor patched 21 days after disclosure and GitHub fixed its flaw 17 days after the researchers found it, while the Codex and VS Code flaws were still open after 94 and 49 days, per the researchers.
As we read it, the response varied by vendor: one silent patch, one independent fix, one report accepted only after a second firm filed the same flaw, and two reports the researchers say remain unpatched.
Gal Weizman, Forever Security, as quoted by The Register, 29 October 2026
“enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model”
Three Implications
FOR DEVELOPMENT TEAMS The report says the unpatched Codex and VS Code flaws are potentially putting developers who use affected configurations at risk.
FOR VENDORS The report says Cursor patched without publishing a security advisory, and that Cursor, GitHub, Anthropic and Microsoft did not respond to The Register.
FOR OPENAI An OpenAI spokesperson told The Register the company is aware of the issue and working to address it.
The vulnerability details and disclosure timeline are Forever Security’s account as The Register reports it; Cursor, GitHub, Anthropic and Microsoft did not respond to The Register’s requests for comment. Whether Claude Desktop is patched is not stated. The day counts are our arithmetic from the dates in the report.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Forever Security found embedded-browser flaws in five AI coding tools, The Register reported, and says the Codex and VS Code flaws remain unpatched. By our arithmetic, the Codex flaw had gone 94 days from disclosure to the report; OpenAI says it is working on a fix.
A note on sourcing. Vulnerability details and the disclosure timeline are Forever Security’s account as reported by The Register on 29 October 2026; this piece gives no technical exploit detail. Day counts are our arithmetic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
