Researchers discover vulnerabilities in AI coding tools allowing malicious file execution
Researchers have identified critical vulnerabilities in several AI coding agents, including OpenAI's Codex, Anthropic's Claude Code/Desktop, Microsoft's VS Code, Cursor, and Copilot. These flaws allow malicious files placed in a user's downloads folder to trick the AI tools into executing dangerous code. This could potentially lead to system compromise, the running of dangerous malware, or the redirection of enterprise data. The discovery was widely reported across multiple cybersecurity and tech outlets, highlighting the risk of AI agents interacting with local file systems without proper sandboxing. The Register specifically noted that some of these vulnerabilities, particularly those affecting OpenAI and Microsoft products, remained unpatched at the time of reporting.
7 articles from 6 outlets covered this story. No difference in framing or figures was found between them. The underlying claim is sourced from a paper.
What do all outlets agree on?
6 outlets covered “Researchers discover vulnerabilities in AI coding tools allowing malicious file execution”. All of them report the following:
- Vulnerabilities found in AI coding agents
- Affected tools include OpenAI Codex, Claude Code/Desktop, VS Code, Cursor, Copilot
- Exploitation involves malicious files in the downloads folder
- Attack can lead to execution of dangerous code or system compromise
- Discovery made by researchers
Did outlets disagree about this?
No. All 6 outlets covering “Researchers discover vulnerabilities in AI coding tools allowing malicious file execution” reported it the same way — no difference in framing or figures was found between them.
Which outlets covered this?
All 7 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.