Hackers found browser bugs in popular AI coding apps that could put developers at risk
Researchers found weaknesses in built-in web viewing features used by several popular AI coding tools, including Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop. These problems could let a harmful webpage trick the app into running unwanted actions, stealing local files, or showing a fake web address to mislead users.
Who is at risk
People who use these AI-assisted desktop tools, especially developers and anyone opening links or web content inside the apps, are most at risk.
What to watch for
Watch for these apps opening unexpected pages, asking for unusual permissions, showing strange pop-ups, or behaving oddly after you click a link or sign in through an in-app browser.
What to do
Update these apps immediately, avoid opening unknown links inside them, and use your regular web browser instead of the app’s built-in browser whenever possible until fixes are confirmed.