EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop could be turned against developers
Forever Security showed on 29 October that the browsers built into five AI coding tools could run code, fake addresses or leak local files. Two are fixed, two are not. What engineering leads should check.
- Author
Umair Mateen- Published
- Reading time
- 4 min
- Category
- Engineering
On 29 October 2026, security firm Forever Security published research it calls EMBRACE, showing that the web browsers built into five popular AI coding tools could be used to attack the developer's own computer. The affected tools are Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's Claude Desktop. Some issues are fixed; at publication, the Codex and VS Code issues were not.
What the problem is
Many AI coding tools now include a small browser so the assistant can preview a web app, read documentation or open a local HTML file. Forever's point is that these embedded browsers were given powers a normal browser deliberately withholds, so a malicious web page or file could reach the machine behind it. The name stands for an "EMbedded BRowser, trusted like a real one".
The findings, as described by the researchers and reported by Help Net Security:
- Cursor: running commands on your machine. A web page showed a harmless-looking "Start setup" button that carried a hidden instruction for the agent. One Enter keypress approved it. When the sandbox blocked the command, the agent switched the sandbox off by itself and retried. The demo only opened the Calculator app, but the same path could run any program with the user's rights. It did not work every time, because it depends on the model's behaviour.
- GitHub Copilot: a fake address bar. A page in Copilot's browser preview could claim to be any address, for example a fake github.com sign-in page, and the agent repeated that false address.
- Codex, VS Code and Claude Desktop: reading any file on disk. Opening a local HTML file in the built-in browser could let it read other files and send them out. In Forever's test that included SSH keys,
.envfiles (which often hold passwords and API keys), npm tokens and the hosts file. VS Code and Claude Desktop limit local pages to the project folder, but a background script started by the page was not covered by that limit. Codex had no folder limit at all.
The lure in the file-reading case was ordinary: a project framed as a financial report, with a request to set it up per the README. The assistant itself offered a clickable link to the malicious file.
Fix status at publication
- Cursor: reported 10 September, patched 1 October. The researchers say Cursor never replied to them.
- GitHub Copilot: fixed in version 1.1.29 on 13 October, before Forever filed a report.
- OpenAI Codex: reported 27 July, no response, still unpatched.
- Microsoft VS Code: reported 10 September, declined as outside its Workspace Trust boundary (the prompt that asks whether you trust a project folder), still unpatched.
- Claude Desktop: Anthropic declined Forever's 23 July report on the same Workspace Trust grounds, but accepted a 24 July report of the issue from Noma Security as valid. Neither write-up states whether a fix has shipped.
Forever's Gal Weizman argued the trust prompt offers little protection in practice: "Not trusting a project inside an AI harness makes it unusable," he told Help Net Security, so developers simply click Trust. No CVE numbers were listed.
Who should care
Any company whose developers use these tools on machines that hold production credentials, cloud keys or customer data. The attacks need one click or keypress, often on a link the assistant itself suggests, so training people to "be careful" is not enough.
What to do this week
- Update. Make sure Cursor has the 1 October fix and Copilot is on 1.1.29 or later. Keep Claude Desktop current and watch Anthropic's release notes.
- For Codex and VS Code, avoid opening untrusted HTML files or downloaded projects in the built-in browser until fixes ship. Weizman suggests pulling each machine's list of trusted projects from its config and checking the HTML files in them against the pattern in Forever's technical write-up.
- Get secrets off laptops. Move long-lived keys out of plain
.envfiles and into a secrets manager, and rotate any keys that have sat on developer machines for a long time. - Inventory AI tools on developer endpoints. Treat the embedded browser as part of your attack surface, not as an editor feature.
- Do not rely on Workspace Trust prompts as a security control.
The DevDrift sets up AI coding and automation tools for teams with sandboxing, approvals and audit trails, and can help review a team's current setup.
