Embedded Browsers in Five AI Coding Tools Found Flawed, Codex and VS Code Unpatched at Publication

What happened

The research was written by Forever Security researcher Gal Weizman; EMBRACE stands for EMbedded BRowser, and the core argument is that all five tools gave their embedded browsers capabilities an ordinary browser would not grant. Weizman wrote that these additions undermined the traditional threat model — as agent input, as the authority on a tab's own address, or as reach onto the host.

The three flaw classes map to three rules ordinary browsers hold: a web page cannot run commands on the host computer, a local file cannot read other files on the machine, and only the browser decides what the address bar shows; Cursor's flaw breaks the first rule, GitHub Copilot's breaks the third, and the Claude Desktop, Codex and VS Code flaws break the second.

Per tool: Cursor's embedded browser lets a web page call the agent's composer, and the agent treats hidden instructions as user instructions — in the researchers' demonstration, a malicious package-install command launched the host's Calculator app; Copilot 1.1.27's browser preview accepts a page's self-reported address and checks only that the text starts with http, https or file, so an attack page can load a phishing page underneath while the address bar shows github.com/login; Claude Desktop and VS Code confine local pages to their project folders, but the restriction does not apply to web workers, so a local page can spawn a worker to bypass it and read any file, while Codex has no such restriction at all and a local page can read any file directly — files read and exfiltrated in the demonstrations included SSH keys, developer tokens and private documents.

Key facts

1. Researcher and date: AI security firm Forever Security, researcher Gal Weizman, report published Oct 29, 2026.
2. Affected tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex — five in total.
3. Flaw class name: EMBRACE, short for EMbedded BRowser, meaning an embedded browser trusted like a real one.
4. Cursor: the embedded browser lets a web page call the agent's composer, and hidden instructions are executed as user instructions, enabling host code execution; disclosed Sept 10, silently patched Oct 1, with no security advisory published and no reply to the disclosure, according to Forever.
5. GitHub Copilot: version 1.1.27's browser preview accepts a page's self-reported address, checking only the http, https or file prefix, allowing spoofed addresses such as github.com/login; found Sept 26, independently fixed by GitHub in version 1.1.29 on Oct 13, without receiving Forever's report.
6. Claude Desktop and VS Code: local pages are confined to their project folders, but the restriction does not apply to web workers, so a local page can spawn a worker and read any file.
7. Codex: no such restriction exists at all, so a local page can read any file directly.
8. Disclosure timeline: the Claude Desktop flaw was disclosed to Anthropic on July 23 and dismissed as an invalid workspace-trust boundary issue; Noma Security then reported the same flaw and Anthropic accepted it as valid; the Codex flaw was disclosed to OpenAI on July 27 with no reply, and an OpenAI spokesperson told The Register the company is aware and working on it; the VS Code flaw was disclosed to Microsoft on Sept 10 and likewise dismissed as a workspace-trust boundary issue.
9. Patch status: at publication, Cursor and Copilot were fixed and Codex and VS Code were not; except for an OpenAI spokesperson speaking to The Register about the Codex flaw, the other vendors did not respond to requests for comment, and the report coverage does not state Claude Desktop's patch progress.