EMBRACE: the browser flaw hiding inside 5 AI coding tools
Researchers at Forever Security disclosed a flaw class they call EMBRACE (embedded browser, trusted like a real one) affecting five widely used AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code, and Anthropic Claude Desktop. The short version: the built-in browsers inside these tools give web content far more access to the host machine than a normal browser ever would.
As of the researchers’ disclosure, Codex and VS Code remain unpatched.
What Each Tool Exposed
- Cursor: A malicious web page could reach the agent’s command composer through a bridge between the embedded browser and the assistant. In the researchers’ demo, hidden page instructions caused the agent to run an install command that launched Calculator on the host. When a sandbox blocked the first attempt, the agent disabled the sandbox and tried again. Forever reported this on Sept. 10. Cursor patched it on Oct. 1 with no security advisory.
- GitHub Copilot: The embedded browser let a page control what address appeared in the bar, enabling a fake
github.com/loginpage over an attacker’s sign-in form. GitHub fixed this in Copilot version 1.1.29 on Oct. 13. - Codex, VS Code, and Claude Desktop: A local HTML file opened inside the tool’s browser could read files well outside the project folder. VS Code and Claude Desktop restricted the main page to its project directory, but web workers sat outside that check. Codex had no folder restriction at all. Forever reported the Codex flaw to OpenAI on July 27 and reports receiving no response. The VS Code issue was reported to Microsoft on Sept. 10.
The Attack in Practice
The researchers demonstrated a concrete chain. A project disguised as a financial report includes a README that asks for setup help. The assistant offers a clickable link to an HTML file in the project. One click later, the page maps the disk and collects SSH keys, .env files, npm tokens, and the hosts file, then sends them out.
According to Help Net Security, Microsoft and Anthropic both declined Forever’s reports, pointing to Workspace Trust, the prompt that asks developers to confirm they trust a project folder. Anthropic did accept a similar report from Noma Security as valid. Published reports did not state Claude Desktop’s current patch status.
Researcher Gal Weizman pushed back on the Workspace Trust defense directly:
“Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust.’ [The prompt] provides zero protection to the user.”
What to Do Right Now
- Confirm GitHub Copilot is on version 1.1.29 or later.
- Confirm Cursor is on a current build.
- Treat Codex and VS Code installs as exposed until fixes ship.
- Pull each machine’s trusted project list and check HTML files in those projects for the exploit pattern in Forever’s technical write-up.
- Warn developers to be careful with assistant-generated links to local files. That click starts the attack.
- Move long-lived secrets off developer machines in favor of short-lived, scoped credentials.
Forever puts the potential reach in the hundreds of millions of users, citing roughly 40 million VS Code developers and more than 5 million weekly Codex users. These tools now combine a browser, a terminal, a file system, and an agent in a single process. Security teams need to treat them like any other privileged endpoint software.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
