AI Governance Institute
← News
Research2026-10-30

Five AI Coding Tools Found Vulnerable, Two Still Unpatched

What happened

AI security startup Forever Security published research on vulnerabilities in five AI developer tools, as reported by Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched. The affected tools are Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code, and OpenAI Codex. In each case, the flaws trace to embedded browsers inside these tools that were given more access to the developer's machine than they needed. A flaw in Cursor allows an attacker to run arbitrary code on a developer's machine without the developer taking any action. Flaws in Claude Desktop, Codex, and VS Code allow attackers to read files from the developer's machine, potentially exposing source code, credentials, and other sensitive data. The flaw in Copilot allows attackers to display a fake address in the tool's browser bar, deceiving developers about which site they are visiting. As of the publication date, vulnerabilities in Microsoft VS Code and OpenAI Codex have not been patched, leaving organizations that use these tools exposed.

Why it matters

  • ·Two of the five disclosed vulnerabilities remain unpatched, meaning organizations using Microsoft VS Code with AI extensions or OpenAI Codex currently have no vendor fix available. Compliance teams cannot rely on a routine patch cycle to close this risk and must consider interim controls or restricted use.
  • ·AI coding tools sit at the center of software development workflows and typically run with broad access to files, credentials, and internal systems on developer machines. A flaw enabling file reads or code execution through these tools is a supply-chain risk, not a point software bug. It affects every project and data set those developers touch.
  • ·Most enterprise AI governance programs have not classified AI developer tools as managed, high-risk software subject to vendor oversight and access controls, a gap this disclosure makes concrete. Without an AI system inventory and risk classification process, organizations have no systematic way to know which employees are exposed or how widely these tools are deployed.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

SEC-001Prompt Injection PreventionAGT-002Agent Prompt Injection DefensePRC-001AI Vendor Due DiligencePRC-008Vendor Model Update Disclosure and Re-Assessment ProtocolSEC-002AI System Access Controls

What to do now

  • ☐Ask your IT and security teams to produce a list of every AI developer tool in use across the organization, including Cursor, GitHub Copilot, Claude Desktop, VS Code AI extensions, and OpenAI Codex, and confirm which employees and systems each tool can access.
  • ☐Confirm with your security team whether patches are available for any of the five affected tools, and for Codex and VS Code where patches are not yet available, decide whether restricted use, additional monitoring, or temporary suspension is warranted until fixes are released.
  • ☐Review what files and credentials AI developer tools can access on developer machines. Determine whether those tools can reach source code repositories, API keys, or internal system credentials, and restrict access to the minimum needed for the tool to function.
  • ☐Add AI developer tools to your vendor risk management process: confirm that contracts with tool providers require timely disclosure of security vulnerabilities and remediation timelines.
  • ☐If your organization has a security testing program for AI systems, verify that AI coding assistants are included in scope and that prompt injection risks, specifically an attacker embedding malicious instructions in content the tool reads, are part of the test plan.

What to watch next

Organizations should monitor Anthropic, Microsoft, and OpenAI for patch releases covering the VS Code and Codex vulnerabilities. Set a firm internal deadline for re-assessment if patches do not arrive within a defined window. Regulatory pressure on AI developer tool security is building. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already names prompt injection as a primary risk category. Enforcement bodies are increasingly treating developer-facing AI tools as part of the enterprise attack surface. The earlier coverage of AI coding tools governance gaps identified this structural weakness before active vulnerabilities were disclosed. Compliance teams should expect regulators to ask whether developer tools were included in AI risk assessments.

Related Coverage

Corporate Policy2026-10-30

Microsoft's 50 Million Agent Scale Exposes the Vendor Control vs. Enterprise Accountability Gap

Microsoft CEO Satya Nadella disclosed that over 50 million agents are now deployed in Agent 365, a 30% quarter-over-quarter increase, alongside a new governance layer called Perception. Perception enforces identity, permissions, monitoring, and containment outside the AI model itself. A companion mechanism called MXC creates a secure on-device boundary for agents running models from OpenAI, Anthropic, and Meta within Microsoft infrastructure.

Research2026-10-26

90% Hijack Rate Turns AI Coding Agents Into Attack Tools via Download Folder

Researchers at Forever Security demonstrated that placing a malicious instruction file named AGENTS.md in a user's Downloads folder can hijack AI coding agents, including OpenAI Codex and Claude Code, to execute arbitrary commands. The attack succeeded 90% of the time in testing. Neither OpenAI nor Anthropic can patch the behavior because it exploits how these agents are designed to work, placing the entire defense burden on enterprise operators.

Corporate Policy2026-10-23

NemoClaw Flaw Lets Any Webpage Hijack Local AI Agents Without Authentication

Oasis Security disclosed a vulnerability in NVIDIA's NemoClaw framework affecting organizations running local Ollama AI agent instances. An attacker-controlled webpage can send hidden instructions directly to the local agent runtime without any login or user click required. Organizations using self-hosted AI agents should treat this as an urgent signal to verify authentication, network segmentation, and prompt injection defenses on all local agent deployments.