Five AI coding assistants had browser flaws that could break the sandbox

A flaw in the front door

AI coding assistants have become part of the daily routine for millions of developers. Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop all include built-in browsers to display documentation, preview generated code or fetch resources. Those browsers are supposed to run in a sandbox: a controlled environment where code from the web can't reach the rest of your machine.

Security researchers at HUMAN have now shown that sandbox didn't hold ^[1]. They found vulnerabilities in all five tools that allowed a malicious web page or a crafted project file to break out. Once out, an attacker could execute code, read local files or steal credentials. Three of the flaws have been patched. Two remain open.

The comparison is straightforward. A sandbox is like the glass screen at a bank counter: you can pass something through the slot, but you can't reach behind it. These flaws were cracks in the glass. A cleverly folded note could slip through and land where it shouldn't.

What the researchers found

The team tested five popular AI coding assistants between March and August 2026 and reported what they found to the developers. Each assistant had its own weakness, but the pattern was similar: an attacker could craft a web page or a file that the assistant would load, and that content could then escape the sandbox to run code on the developer's machine ^[1].

In Cursor, a malicious web page could execute arbitrary code. In GitHub Copilot and OpenAI Codex, attackers could access local files through the sandboxed browser. In VS Code, crafted URIs allowed unauthorised file access. In Claude Desktop, malicious files in a project could trigger code execution when the assistant processed them.

Three vendors patched their tools after disclosure. Microsoft fixed VS Code. Anthropic updated Claude Desktop. Cursor, GitHub Copilot and OpenAI Codex remain vulnerable ^[1]. The researchers haven't published technical details yet, to give users time to update and developers time to respond.

Why it matters for evidence

The immediate worry is obvious: an attacker who can run code or read files on a developer's machine can do a lot of damage. They can steal source code, credentials, API keys or customer data. They can plant backdoors or ransomware. That's the security side.

The evidence side is harder. Once a breach is discovered, the question becomes: what did the attacker access, when and for how long? If the assistant's logs are kept by the same people who run the system, and if those logs can be quietly edited, proving what happened becomes difficult. That matters in incident reporting, in audits and in disputes.

Under the EU Cybersecurity Act, organisations must report significant incidents to their national authority within 24 hours of becoming aware of them ^[2]. The clock starts when you know, not when it suits you. If an attacker has been inside for weeks through a coding assistant, showing when the breach started and what was taken requires logs you can trust.

For AI systems classed as high-risk, Article 12 of the AI Act requires automatic logging of events over the system's lifetime ^[3]. That applies from 2 December 2027 for systems listed in Annex III. The rule says what to log. It doesn't say how to protect those logs once they exist. A log that an administrator can rewrite is easy to challenge on the day someone asks what your AI did during an incident.

What this means for you

If you or your team use any of these tools, check which version you're running. For VS Code and Claude Desktop, update to the latest release. For Cursor, GitHub Copilot and OpenAI Codex, watch for vendor announcements and apply patches as soon as they appear.

Next, ask yourself a few questions. Does your organisation know which coding assistants are in use, and on which machines? Do you have a way of showing what those assistants accessed or executed during a given period? If a breach happened through one of them, could you prove when it started and what was taken?

Those are not comfortable questions, but they are practical ones. Coding assistants are productivity tools, and they will keep spreading. Treating them as part of your attack surface, rather than as neutral helpers, is the reasonable response.

Logs you can check

Here, the thing to seal is each log entry as the assistant writes it: the file accessed, the code executed, the resource fetched and the time. Sealing takes a fingerprint of the entry, not the content itself, so sensitive data never leaves your systems.

You seal through WitniumChain's REST API, SDK or MCP server. The entry stays with you. The fingerprint goes onto a chain where any later change would show, even one made by an administrator. If an incident is reported six months later, anyone you share the log with can check that it's the one written on the day, character for character.

It doesn't show that the log is complete, or that the breach was your fault, or that you responded properly. It shows that the log you're presenting is the log that was written at the time, unchanged. That shortens the argument about what happened, because the other side doesn't have to trust you to believe the log.

Sealing log entries as they are written means the record exists before anyone knows there's a problem. Once something has gone wrong, it's too late to start.

How it would work

1. The assistant writes a log entry (file access, code execution, network call).
2. Your logging system sends a fingerprint of that entry to WitniumChain and gets a witness ID back.
3. When the incident is investigated, you calculate the fingerprint again and compare. If it matches, the entry hasn't changed.

What to watch

The technical details of these vulnerabilities have not been published yet. When they are, expect more scrutiny of how AI tools handle untrusted content and what protections are in place.

For organisations using AI in software development, the dates in the AI Act matter. High-risk systems under Annex III must meet the logging requirement from 2 December 2027 ^[3]. Systems under Annex I follow from 2 August 2028. Whether a coding assistant counts as high-risk depends on what it does and who uses it, but the logging question applies to any system where you might later need to show what happened.

The window between disclosure and patching is when the damage happens. Knowing that window existed is one thing. Proving what happened during it is another.