Forever Security found the built-in browsers in five AI coding tools give pages powers a normal browser withholds. Codex and VS Code remain unpatched.
Forever Security has disclosed a class of flaws it calls EMBRACE (EMbedded BRowser) in the built-in browsers of Cursor, GitHub Copilot, Claude Desktop, OpenAI Codex and Visual Studio Code. Published on 29 October 2026 by researcher Gal Weizman, the work says each vendor gave its embedded browser abilities a normal browser withholds. No CVE identifiers have been assigned. Per the researchers, Codex and VS Code are still unpatched; the Claude Desktop fix status is not stated.
What was found
Cursor (code execution). Cursor's integrated browser exposed a bridge to every page, with no origin check or user gesture. A hostile page could send a forged element-selected message that placed a "chip" in the agent's composer, and the agent treated its fields as instructions. The command was split across fields to slip past filters. With auto-run on and an empty allowlist, a single approval card appeared, and the payload focused it so one Enter keystroke approved it. When the sandbox blocked npm install, the agent retried outside it, so a preinstall script ran with full privileges. The researchers launched Calculator on macOS; success depends on the model and is probabilistic. Cursor was told on 10 September, patched silently on 1 October, published no advisory and did not respond to the researchers or The Register.
GitHub Copilot (context spoofing). A page could report its own URL to the app over IPC. The app checked only that it began with http, https or file and carried no credentials, not where the tab really pointed. The address bar and the agent both saw a forged address such as github.com/login while the content came from an attacker's host. Confirmed on Copilot 1.1.27 on 26 September; GitHub fixed it in 1.1.29 on 13 October without a report from the researchers.
Claude Desktop, Codex and VS Code (file exfiltration). Pages opened from file:// can read sibling files, and reads outside the project folder are meant to be blocked. In Claude Desktop and VS Code the fence runs only in the top document, so a web worker, including one built from an in-memory blob, can read any local path. Codex has no fence, so a plain fetch works. On macOS, .DS_Store files let the attacker list directories and walk the home folder. The sweep recovered SSH keys, .env files, npm tokens and private documents, sent to a localhost sink in the proof of concept.
The lure is a project dressed up as a financial report with one malicious worker or script. When the user asks the assistant to set it up from the README, it renders a clickable file:// link, and one click starts the read.
Codex and VS Code were still unpatched when EMBRACE was published on 29 Oct, 94 and 49 days after they were reported; Cursor and Copilot got fixes, and Claude Desktop's status was not stated.
Vendor responses
- Anthropic: declined the 23 July report as invalid under its Workspace Trust boundary, then accepted Noma Security's report of the same flaw a day later. It did not answer The Register's questions.
- OpenAI: no reply to the 27 July report; a spokesperson told The Register it is aware and working to address it.
- Microsoft: rejected the 10 September VS Code report as outside the Workspace Trust boundary and did not respond to The Register.
What defenders should do
The sources offer no vendor mitigations beyond the Cursor and Copilot fixes, so the following is practical inference. Update Cursor and Copilot to current builds. Treat repositories from outside your organisation as untrusted even when the assistant offers to set them up. Do not click file:// links an assistant renders, avoid running agents with auto-run and empty allowlists, and keep SSH keys and tokens out of plain .env files on machines that run Codex or VS Code assistants. Watch the OpenAI and Microsoft channels for fixes.