EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched
Embedded browsers in AI coding assistants (Cursor, GitHub Copilot, OpenAI Codex, VS Code, Claude Desktop)
Forever Security published research on Oct 29 2026, which it calls EMBRACE, showing that the browsers built into five AI coding assistants let a web page or a local file reach the computer behind them. In Cursor a booby-trapped page got the agent to run a command on the host with a single Enter (fixed Oct 1). In GitHub Copilot a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29). In Codex, VS Code and Claude Desktop a single local HTML file opened in the built-in browser could read and exfiltrate any file on the disk, such as SSH keys, .env files and npm tokens. Codex and VS Code had no fix at publication: Microsoft declined the report citing Workspace Trust, and OpenAI never replied.
Why this severity: One click on a link the assistant itself draws, after opening a rigged project, lets a local file read the whole disk and send out SSH keys, cloud credentials and developer tokens; still open in Codex and VS Code. The Cursor code-execution path depends on the model and does not work every time.
- Started
- Oct 29, 2026
Affected
- GitHub Copilot 1.1.27 (address bar spoofing)
- OpenAI Codex (local file read, unpatched as of Oct 29 2026)
- VS Code (local file read, unpatched as of Oct 29 2026)
Fixed in
- GitHub Copilot 1.1.29
- Cursor (patched Oct 1 2026)
Timeline7
Forever Security publishes EMBRACE and a technical companion; the Codex and VS Code local-file-read issues are still unpatched at publication.
Help Net Security covers the research and confirms Codex and VS Code had no fix as of Oct 29.
GitHub fixes the Copilot address bar spoofing (found on 1.1.27) in Copilot 1.1.29, before Forever had sent a report.
Cursor patches its flaw without replying to the researchers.
Forever Security discloses the Cursor code-execution issue to Cursor and the VS Code issue to Microsoft; Microsoft declines it as gated by Workspace Trust.
Forever Security reports the Codex issue to OpenAI and never hears back.
Forever Security reports the Claude Desktop local-file-read issue to Anthropic, which declines it as gated by Workspace Trust; a report from Noma Security filed on July 24 is accepted as valid.
News & write-ups3
- EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI AssistantsForever Security · Oct 29, 2026 · Write-up
- EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI AssistantsForever Security · Oct 29, 2026 · Write-up
- Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude DesktopHelp Net Security · Oct 29, 2026
Notes & caveats
No CVE ids have been assigned. In Claude Desktop and VS Code the local page is limited to its project folder, but a web worker started by the page is not, so it can read any file; Codex had no folder restriction at all. The attack uses macOS .DS_Store index files to map the disk. Whether Anthropic has since fixed the Claude Desktop issue is not stated in the write-up.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
