{"resourceId":"register-embrace-embedded-browser-flaws-github-copilot-fixed-vs-code-unpatched-20261029","versions":[{"version":"external-66cb97b8a85e052dd774907978daaea62801463f04df91debef49b62fb871c20","resource":{"id":"register-embrace-embedded-browser-flaws-github-copilot-fixed-vs-code-unpatched-20261029","title":"The Register: researchers report embedded-browser flaws in five AI developer tools; GitHub Copilot address-bar spoofing was fixed, while the VS Code issue remains unpatched after Microsoft labelled it invalid (Oct 29)","organization":"Forever Security (researchers); Microsoft / GitHub (affected vendors)","sector":"Developer tools (higher-ed and government IT teams)","geography":"Global","publishedAt":"2026-10-29","publicationDate":"2026-10-29","eventDate":"2026-10-29","sourceName":"The Register","sourceLabel":"Technology news report on a security research disclosure","sourceUrl":"https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["developers-agents","data-security"],"finding":"The Register reports that Forever Security found a vulnerability class it calls 'Embrace' (embedded browser) in Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex: embedded browsers given capabilities beyond a normal browser. For GitHub Copilot, the researchers found address-bar spoofing in version 1.1.27 on Sept. 26, which GitHub fixed independently in 1.1.29 on Oct. 13. For VS Code, local HTML pages could use web workers to bypass project-folder restrictions and read other files. Forever disclosed this to Microsoft on Sept. 10; Microsoft labelled it an invalid workspace-trust-gated issue, and the researchers say it remains unpatched. Microsoft did not respond to The Register.","sledRelevance":"Limited but real: universities and government IT teams widely use VS Code and GitHub Copilot, so an unpatched local-file exposure and an AI-agent attack surface affect developer endpoints that handle institutional code and data. No sector tag is applied because the issue is not specific to a SLED function.","evidence":"Trade press account of vendor-independent security research, with timelines. Microsoft's position is reported second-hand; no CVE is cited for the VS Code issue.","architectureImplications":"AI coding assistants with embedded browsers expand the endpoint attack surface beyond the code editor's traditional trust model.","governanceImplications":"A vendor can classify a researcher-reported issue as out of scope (workspace trust), leaving organisations to decide their own mitigations.","securityPrivacyImplications":"Local file reads from the VS Code embedded browser could expose credentials or research data on developer machines if untrusted HTML is opened.","caveats":"Researcher claims; Microsoft did not comment. Exploitation conditions (affected configurations, workspace trust) are not fully detailed. The tool set is multi-vendor; only the GitHub Copilot and VS Code findings are Microsoft-related.","streamIds":["microsoft"],"roles":{"sales":"Sales framing: for university and agency IT teams adopting GitHub Copilot and VS Code, this report raises a fair question: how are AI developer tools patched and governed on managed endpoints? A bounded secure-developer-environment review is a reasonable offer. Do not overstate risk; the Copilot flaw was fixed, and the VS Code issue depends on workspace trust and opening untrusted local files. Microsoft disputes its validity.","engineering":"Engineering framing: check GitHub Copilot extension versions (1.1.29 or later fixes the spoofing issue) and VS Code workspace-trust settings across managed developer machines. Restrict opening untrusted local HTML in embedded browsers where possible. Isolate research data and credentials from developer workspaces, and consider dev containers or virtual desktops for sensitive projects. Track the VS Code issue for any fix, since the researchers say it remains unpatched.","delivery":"Delivery framing: add AI developer tools to endpoint patch compliance. Inventory VS Code and Copilot versions, enforce minimum versions, publish developer guidance on workspace trust, and set a review trigger for new disclosures about these tools. For research computing, document which projects need isolated environments. Report compliance monthly to the security office until the VS Code issue is resolved or formally accepted as a risk."},"roleDetails":{"sales":{"customerProblem":"Institutions adopting AI coding assistants lack controls for their new endpoint attack surface.","stakeholders":["CISO","Research computing leads","Developer platform owners","Procurement"],"discoveryQuestions":["Do you inventory VS Code and Copilot extension versions?","Are workspace-trust settings enforced?","Where do developers handle sensitive research data?","How do vendors report and fix AI tool vulnerabilities?"],"valueHypothesis":"A secure developer-environment review may reduce exposure from AI coding tools without slowing adoption.","potentialEngagement":"A short endpoint and configuration review for AI developer tools.","unsupportedClaims":["That the VS Code issue has been exploited","That GitHub Copilot is still vulnerable","That Microsoft accepts the finding"]},"engineering":{"fit":"University and government development teams using VS Code and GitHub Copilot.","architectureIntegration":"Embedded browsers in AI developer tools sit on managed endpoints alongside code, credentials and data.","prerequisites":["Endpoint management for developer tools","Workspace-trust policy","Version inventory"],"constraints":["Unpatched VS Code issue per researchers","Vendor disputes validity","Multi-vendor tooling"],"security":"Enforce workspace trust, avoid opening untrusted local HTML, and isolate sensitive data from developer workspaces.","proofOfValue":["Confirm all endpoints run GitHub Copilot 1.1.29 or later","Test whether local HTML can read files outside the project under current settings"]},"delivery":{"work":"Endpoint compliance and guidance for AI developer tools.","dependencies":["Endpoint management tooling","Security office","Developer communication"],"ownership":"Central IT security with developer platform owners.","skillsAdoption":"Developer briefing on workspace trust and safe handling of local files.","governanceCheckpoints":["Version compliance check","Security review of new disclosures","Risk acceptance or fix decision for VS Code issue"],"acceptanceCriteria":["Proposed: 95% of managed endpoints on fixed Copilot versions within 30 days","Proposed: documented decision on the VS Code issue"],"risks":["Unmanaged personal developer machines","Silent vendor fixes missed","Data exposure on research endpoints"]}},"retrievedAt":"2026-11-01T03:09:01Z","enrichedAt":"2026-11-01T03:16:44Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Developers need guidance on workspace trust and on opening untrusted local HTML.","procurementImplications":"Institutions standardising on GitHub Copilot should ask about vulnerability disclosure handling and patch timelines.","operatingModelImplications":"Endpoint management must cover AI developer tool versions, not just operating systems.","sourceVerification":{"openedUrl":"https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508","referenceExcerpt":"the vendor also labeled it as an invalid workspace trust gated security boundary issue. The researchers claim it remains unpatched.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}