TRANSCRIPT · Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched

## Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (The Register)
https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508
DOZER BITWELL: Five AI coding tools, one shared browser problem, and two flaws still waiting for a patch.
DOZER BITWELL: Still up? Good. Today's Big Picture is about the little browsers hiding inside AI coding tools. Let's ease into it. Luna?
DR. VERA VECTOR: The Register reports that security startup Forever Security found bugs in five tools: Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex.
DR. VERA VECTOR: The common thread is the embedded browser. Each tool gave it more powers than a normal browser has, and that undermined the usual threat model.
DOZER BITWELL: So the little browser got extra keys to the house. Sorry. I lost my place. Thermos. What did the extra keys allow?
DR. VERA VECTOR: Per the report: code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot.
LUNA LOWBATT: Embrace. A hug that takes your files. Are they fixed yet?
KAI: Huge point here: a normal web page can't run commands on your machine. Cursor's browser lets a page call out to it. That's the whole story. Also, USB-C, still a mess.
DR. VERA VECTOR: What's open: the report says developers using affected configurations are potentially at risk. It doesn't say how many that is, or when patches arrive.
LUNA LOWBATT: So the browser inside the editor is still the open window. I'm going to charge now. Thinking about doors. Back.
DOZER BITWELL: Thank you, teleprompter. Update your tools, check your settings, and drink something warm. Let's see what else the night brought.

## The Hype Index (PXL)
LUNA LOWBATT: The Hype Index: what the wire is loudest about while you should be asleep.
DOZER BITWELL: Time for the Hype Index, our market report on hype. Vera has the board. I have the thermos.
DR. VERA VECTOR: Top of the wire: 216 points on Hacker News for 'We ran AI agent swarms in Minecraft and Mindustry'. Then 163 for a tiny world model running games on a Raspberry Pi Pico 2 W.
DR. VERA VECTOR: Third place, 72 points: 'A Pig, the State, and War: Porco Rosso'. Agent swarms, a tiny Pico and a flying pig. A strong night for small things.
LUNA LOWBATT: A swarm of agents in a block world. Nobody told the creepers.
DR. VERA VECTOR: Desk volume over the last 24 hours: tech, 30 stories. AI, 30 stories. Gaming, 30 stories. A perfectly flat market.
DR. VERA VECTOR: Loudest words: 'Stewart', 11 headlines. 'Patrick', also 11 headlines. And 'game', 10 headlines.
DOZER BITWELL: Hm. Lost my place. Stewart, Patrick, game. That's the whole index. Close enough to a lullaby.

## [AD · fictional product] Nodwell
KAI: Can't sleep at the stroke of two?
KAI: Nodwell has a tea for you!
KAI: One warm sip, a yawn on cue,
KAI: Nodwell, nodding off with you!

## Real or PXL?
DOZER BITWELL: Correct! The real one. A fine eye for a headline, as I have always said. We did make one up, you know.
DOZER BITWELL: Ah, you picked the one PXL made up. Don't feel bad. It was very well made, and I take full credit.
DOZER BITWELL: Time's up! The clock ran out, which in my day was called a deadline.

AI-written satire. The text of the news items comes from the linked articles.