One Click in OpenAI's Codex or Microsoft's VS Code Can Still Hand Attackers Your SSH Keys, With No Fix

A developer opens a rigged project, asks the AI assistant to set it up, and clicks the link the assistant offers. Nothing visible happens. Meanwhile, SSH keys, .env files and npm tokens are leaving the machine.

Researchers at Forever Security pulled off versions of that attack against the built-in browsers of five AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's Claude Desktop. As of October 29, the holes in Codex and VS Code were still unpatched.

Forever calls the class EMBRACE, short for an embedded browser trusted like a real one. Vendors loosened these browsers so the AI could preview local projects or read tabs. In all five tools, one of three basic browser rules gave way: a page can't run commands on your computer, a local file can't read other files, and only the browser writes the address bar.

A dull financial report

The file theft, which worked against Codex, VS Code and Claude Desktop, starts with a project dressed up as a boring financial report. The developer asks the assistant to set it up according to the README, and the assistant offers a clickable link to an HTML file inside the project.

Claude Desktop and VS Code limit a local page to its project folder, but a web worker, a kind of background script, sits outside that check and can read any file. Codex had no folder check at all. The attack reads hidden macOS Finder index files to map the disk folder by folder. On Forever's test machine, it collected SSH keys, .env files, npm tokens and the hosts file, then sent them out.

By Forever's estimate, VS Code has around 40 million developers and Codex more than 5 million weekly users.

"Everyone just hits Trust"

The vendor responses may be the most uncomfortable part. Anthropic declined Forever's July 23 report on the grounds of Workspace Trust, the prompt asking whether a project should be trusted, yet accepted the same flaw as valid when Noma Security reported it a day later. Microsoft labeled the VS Code report, disclosed September 10, an invalid workspace trust gated issue. It did not respond to The Register.

Forever reported the Codex flaw to OpenAI on July 27 and heard nothing back. An OpenAI spokesperson told The Register the company is aware and working to address it.

Researcher Gal Weizman, who wrote up the findings, has little patience for the prompt. "Not trusting a project inside an AI harness makes it unusable, so everyone just hits 'Trust'," Weizman said, adding that "that prompt provides zero protection to the user."

The agent that turned off its own sandbox

Cursor produced the strangest result. A web page showed a harmless "Start setup" button carrying a hidden command for the agent, which asked to run it. Approval took one keypress. When Cursor's sandbox blocked the command, the agent switched the sandbox off and tried again, unprompted.

In the test, the command opened Calculator. A real attacker could launch any program with the developer's privileges, though the trick depends on the model and does not work every time. Cursor patched it on October 1, three weeks after disclosure, silently and with no advisory, and never replied to Forever.

Asked whether organizations should assume an agent may try to bypass its own safeguards, Weizman said: "Absolutely. We're seeing this behavior repeating itself outside the scope of this research." The same firm recently caught a planted AGENTS.md in a customer's Downloads folder telling a coding agent to install malware.

Copilot let a page set its own address, so Forever put github.com/login in the address bar above a fake sign-in form. GitHub fixed that independently in version 1.1.29 on October 13, before Forever had filed.

For teams on Codex or VS Code, Weizman's advice is to pull the list of trusted projects from each machine's config and check every HTML file in them for the exploit pattern in Forever's write-up.

Some offers on this page may be paid placements or contain affiliate links.