# EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched · pwn.watch > Forever Security published research on Oct 29 2026, which it calls EMBRACE, showing that the browsers built into five AI coding assistants let a web page or a local file reach the computer behind them. In Cursor a booby-trapped page got the agent to run a command on the host with a single Enter (fixed Oct 1). In GitHub Copilot a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29). In Codex, VS Code and Claude Desktop a single local HTML file opened in the built-in browser could read and exfiltrate any file on the disk, such as SSH keys, .env files and npm tokens. Codex and VS Code had no fix at publication: Microsoft declined the report citing Workspace Trust, and OpenAI never replied. Page: https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026 · generated 2026-10-29T20:46:10.933Z ## Status - Severity: high · status: live · patch: partial - Product: Embedded browsers in AI coding assistants (Cursor, GitHub Copilot, OpenAI Codex, VS Code, Claude Desktop) - Started: 2026-10-29 - Affected: GitHub Copilot 1.1.27 (address bar spoofing); OpenAI Codex (local file read, unpatched as of Oct 29 2026); VS Code (local file read, unpatched as of Oct 29 2026) - Fixed in: GitHub Copilot 1.1.29; Cursor (patched Oct 1 2026) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026.json - This file: https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026/llms.txt ## Updates (newest first) - 2026-10-29: Forever Security publishes EMBRACE and a technical companion; the Codex and VS Code local-file-read issues are still unpatched at publication. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical) - 2026-10-29: Help Net Security covers the research and confirms Codex and VS Code had no fix as of Oct 29. (https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) - 2026-10-13: GitHub fixes the Copilot address bar spoofing (found on 1.1.27) in Copilot 1.1.29, before Forever had sent a report. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) - 2026-10-01: Cursor patches its flaw without replying to the researchers. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) - 2026-09-10: Forever Security discloses the Cursor code-execution issue to Cursor and the VS Code issue to Microsoft; Microsoft declines it as gated by Workspace Trust. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) - 2026-07-27: Forever Security reports the Codex issue to OpenAI and never hears back. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) - 2026-07-23: Forever Security reports the Claude Desktop local-file-read issue to Anthropic, which declines it as gated by Workspace Trust; a report from Noma Security filed on July 24 is accepted as valid. (https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) ## Fix brief # Security brief: EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched Source: https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 14:38 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Forever Security published research on Oct 29 2026, which it calls EMBRACE, showing that the browsers built into five AI coding assistants let a web page or a local file reach the computer behind them. In Cursor a booby-trapped page got the agent to run a command on the host with a single Enter (fixed Oct 1). In GitHub Copilot a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29). In Codex, VS Code and Claude Desktop a single local HTML file opened in the built-in browser could read and exfiltrate any file on the disk, such as SSH keys, .env files and npm tokens. Codex and VS Code had no fix at publication: Microsoft declined the report citing Workspace Trust, and OpenAI never replied. Severity detail: One click on a link the assistant itself draws, after opening a rigged project, lets a local file read the whole disk and send out SSH keys, cloud credentials and developer tokens; still open in Codex and VS Code. The Cursor code-execution path depends on the model and does not work every time. - Product: Embedded browsers in AI coding assistants (Cursor, GitHub Copilot, OpenAI Codex, VS Code, Claude Desktop) ## Affected versions - GitHub Copilot 1.1.27 (address bar spoofing) - OpenAI Codex (local file read, unpatched as of Oct 29 2026) - VS Code (local file read, unpatched as of Oct 29 2026) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - GitHub Copilot 1.1.29 - Cursor (patched Oct 1 2026) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Update Cursor and GitHub Copilot to current builds (Copilot 1.1.29 or later). In Codex and VS Code, don't open HTML files from untrusted or freshly cloned projects in the built-in browser, even when the assistant offers a link to them, and don't trust project folders you haven't reviewed. Forever suggests checking the HTML files in projects already marked trusted against the pattern in its technical write-up. ## Latest updates - Oct 29, 2026: Forever Security publishes EMBRACE and a technical companion; the Codex and VS Code local-file-read issues are still unpatched at publication. - Oct 29, 2026: Help Net Security covers the research and confirms Codex and VS Code had no fix as of Oct 29. - Oct 13, 2026: GitHub fixes the Copilot address bar spoofing (found on 1.1.27) in Copilot 1.1.29, before Forever had sent a report. - Oct 1, 2026: Cursor patches its flaw without replying to the researchers. - Sep 10, 2026: Forever Security discloses the Cursor code-execution issue to Cursor and the VS Code issue to Microsoft; Microsoft declines it as gated by Workspace Trust. - Jul 27, 2026: Forever Security reports the Codex issue to OpenAI and never hears back. - Jul 23, 2026: Forever Security reports the Claude Desktop local-file-read issue to Anthropic, which declines it as gated by Workspace Trust; a report from Noma Security filed on July 24 is accepted as valid. ## Write-ups & news - [EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers) - [EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical) - [Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) ## Caveats No CVE ids have been assigned. In Claude Desktop and VS Code the local page is limited to its project folder, but a web worker started by the page is not, so it can read any file; Codex had no folder restriction at all. The attack uses macOS .DS_Store index files to map the disk. Whether Anthropic has since fixed the Claude Desktop issue is not stated in the write-up. --- Machine-readable: https://pwn.watch/i/embrace-ai-assistant-embedded-browsers-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.