Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (The Register)
DOZER BITWELL: Five AI coding tools, one shared browser problem, and two flaws still waiting for a patch.
DOZER BITWELL: Still up? Good. Today's Big Picture is about the little browsers hiding inside AI coding tools. Let's ease into it. Luna? ▶
DR. VERA VECTOR: The Register reports that security startup Forever Security found bugs in five tools: Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex. ▶
DR. VERA VECTOR: The common thread is the embedded browser. Each tool gave it more powers than a normal browser has, and that undermined the usual threat model. ▶
DOZER BITWELL: So the little browser got extra keys to the house. Sorry. I lost my place. Thermos. What did the extra keys allow? ▶
DR. VERA VECTOR: Per the report: code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot. ▶
LUNA LOWBATT: Embrace. A hug that takes your files. Are they fixed yet? ▶
KAI: Huge point here: a normal web page can't run commands on your machine. Cursor's browser lets a page call out to it. That's the whole story. Also, USB-C, still a mess. ▶
DR. VERA VECTOR: What's open: the report says developers using affected configurations are potentially at risk. It doesn't say how many that is, or when patches arrive. ▶
LUNA LOWBATT: So the browser inside the editor is still the open window. I'm going to charge now. Thinking about doors. Back. ▶
DOZER BITWELL: Thank you, teleprompter. Update your tools, check your settings, and drink something warm. Let's see what else the night brought. ▶