vibehacker
News
Forever Security ·

EMBRACE research breaks the built-in browsers of Cursor, Copilot, Codex, VS Code and Claude Desktop

Published Oct 29, the research shows a booby-trapped page got Cursor's agent to run a host command (patched Oct 1), and a local HTML file in Codex, VS Code or Claude Desktop could read and exfiltrate files across the disk, with Copilot spoofing the address bar (fixed in 1.1.29). Codex and VS Code were still unpatched at publication, so be careful opening untrusted HTML in their built-in browsers (Help Net Security).

Read at forever.security

More news

View all

Lovable now imports apps from Replit, Bolt, v0, Base44 and Manus, plus any site by URL

Rolling out since Oct 29, you upload a code ZIP (up to 250 MB) and Lovable rebuilds it on TanStack Start, moving your database and users to its backend, though passwords and sessions don't carry over; a public URL import rebuilds only what visitors see, not the CMS, forms or sign in. Your first import is free until a working preview, then it uses normal credits (import page)…

Lovable Docs

DeepSeek Harness alpha adds an experimental tool that hands tasks to your local Codex or Claude Code

Released Oct 28 as pre release dsh v0.2.2 alpha.2, the experimental subagent oar plugin delegates a self contained task to an installed Codex or Claude Code CLI, which works in its own context and returns one final answer with no follow ups or resume. The alpha also lets you update third party plugins with rollback if a hot update fails, and adds six UI languages…

GitHub (deepseek-ai/deepseek-harness)

LangChain's Managed Deep Agents v0.10 adds browser use and async subagents that run in the background

Released Oct 29 in public beta on LangSmith Cloud (US), agents can now work on sites with no API and hand you the browser window at sign in so passwords stay out of traces, and a subagent marked async runs long jobs while the main agent keeps chatting. It also replies in the originating Slack thread with a Stop button, and drops connectors.mcp() in favor of declaring MCP servers in tools/mcp.py or tools/mcp.ts…

LangChain Blog

Spotted something we missed? Start a thread.