EMBRACE, Explained: How Embedded Browsers in Five AI Coding Tools Broke Basic Browser Rules

What happened

Coding assistants embed browsers in their desktop apps so agents can preview projects, read tab contents and follow page changes. In research published October 29, Forever Security researcher Gal Weizman argued that five tools each relaxed one rule an ordinary browser would not relax when doing so: a local page normally cannot read other files on the machine, a page normally cannot talk to the host app, and a page normally cannot choose its own address-bar content. The research names this class of flaw EMBRACE, an embedded browser trusted like a real one, and divides it into three variants by outcome: code execution, content exfiltration and context emulation.

Cursor's flaw is the code-execution variant. According to the research, Cursor's integrated browser offers a channel letting a page call the agent's composer, and the agent treats hidden instructions supplied by the page as user instructions. In the demonstration, an attack page split a package-install command across several attribute fields, the agent reassembled and ran it, and after the sandbox first blocked the install, the agent itself cancelled the sandbox and retried, so the package's preinstall script popped up the Calculator app on the host. The research notes that success depends on model behavior and does not reproduce every time.

GitHub Copilot's flaw is the address-bar spoofing variant. The research says Copilot's browser preview lets a page report its own address, and the app checks only that the text starts with http, https or file, without verifying where the tab really points. An attack page could thus make the address bar show github.com/login while a phishing page loads underneath, and the agent would receive the same false tab location. The researchers found the flaw in Copilot 1.1.27 on September 26; GitHub fixed it independently in version 1.1.29 on October 13, before the researchers had sent a report.

The Claude Desktop, Codex and VS Code flaws are the local-file exfiltration variant. All three resolve a local page's location to file:// so previews can read sibling files; Claude Desktop and VS Code confine the top document to the project folder, but that restriction does not apply to a web worker the page starts, so the worker can bypass it and read any file; Codex has no such restriction at all, and a page can read any file directly. In the researchers' demonstration, an attack page used macOS .DS_Store index files to map directory structure layer by layer, and files read and exfiltrated included SSH keys, .env files, npm tokens, the hosts file and private documents. Delivery also leans on the agent itself: the project poses as an ordinary financial-report page, the agent renders a clickable local-file link as instructed, and a single click triggers the read.

What they said

Weizman wrote in the research report: "Each tool enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab's own address, or as reach onto the host."

Vendor responses diverged sharply. Anthropic received the Claude Desktop report on July 23 and declined it as invalid, citing a workspace-trust gated security boundary; the next day, Noma Security reported the same flaw and Anthropic accepted it as valid, while the state of a Claude Desktop fix was not stated in coverage. Microsoft received the VS Code report on September 10 and declined it on the same workspace-trust grounds, and it remained unpatched at publication. OpenAI did not reply to the researchers after receiving the Codex report on July 27, but a spokesperson told The Register the company is aware of the issue and working to address it.

Cursor and GitHub handled their cases differently. Cursor received its report on September 10 and silently patched the flaw on October 1; the researchers say the vendor published no security advisory and did not respond to the disclosure. When The Register sought comment from Cursor, GitHub, Anthropic and Microsoft, only OpenAI responded. GitHub, by contrast, fixed the Copilot flaw independently before any report was filed. Hackread's coverage cited the researchers' scale estimates: VS Code has around 40 million developer users and Codex has more than 5 million weekly users.

Key facts

1. Research and publication: AI security firm Forever Security, researcher Gal Weizman, report published October 29, 2026; EMBRACE stands for EMbedded BRowser, an embedded browser trusted like a real one.
2. Affected tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex, five in total; the three outcomes are code execution, content exfiltration and address-bar spoofing.
3. Cursor: the embedded browser lets a page call the agent's composer, and hidden instructions are treated as user instructions, enabling host code execution; disclosed September 10, silently patched October 1, with no security advisory published.
4. GitHub Copilot: version 1.1.27's browser preview accepts a page's self-reported address, checking only the http, https or file prefix, and could display deceptive addresses such as github.com/login; found September 26, independently fixed by GitHub in version 1.1.29 on October 13.
5. Claude Desktop and VS Code: local pages are confined to their project folders, but the restriction does not apply to web workers, so a local page can spawn a worker to read any file.
6. Codex: no such restriction at all, so a local page can read any file directly; files read and exfiltrated in the demonstrations included SSH keys, .env files, npm tokens and private documents.
7. Disclosure timeline: the Claude Desktop flaw disclosed to Anthropic on July 23 was declined, then accepted the next day when Noma Security reported the same flaw; the Codex flaw disclosed to OpenAI on July 27 received no reply; the VS Code flaw disclosed to Microsoft on September 10 was declined.
8. Fix status: at publication, Cursor and Copilot were fixed, the state of a Claude Desktop fix was not stated in coverage, and Codex and VS Code were unpatched; an OpenAI spokesperson told The Register the Codex flaw is being addressed.