Problem Solutions
Your Coding Agent’s Built-In Browser Can Be Hacked: The EMBRACE Flaws in Cursor, Copilot, Codex, VS Code and Claude Desktop
Researchers at AI security startup Forever Security published EMBRACE on October 29: flaws in the built-in browsers of five AI coding tools — Cursor, GitHub Copilot, Claude Desktop, VS Code and OpenAI’s Codex. Each tool gave its embedded browser powers a normal browser does not have, and those extras broke the usual security boundaries: what counts as agent input, what a tab’s address really is, and how far a page can reach onto the host machine.
What broke in each tool
Cursor — code execution. A web page could call the agent’s composer, so the agent treated hidden page content as instructions — a prompt-injection opening that could lead to commands running on the host. Forever disclosed it on September 10; Cursor silently patched it on October 1, with no advisory and no reply to the researchers.
GitHub Copilot — address-bar spoofing. Some pages change their address without loading a new page, and Copilot’s preview let the page tell the app its own address — so a fake login page could show github.com in the address bar. The flaw was found in Copilot 1.1.27 on September 26; GitHub fixed it independently in build 1.1.29 on October 13, without receiving Forever’s report.
Claude Desktop, VS Code and Codex — file theft. Local HTML files opened in the built-in browser could escape its boundaries and read other files. Claude Desktop and VS Code limit local pages to their project folders, but the researchers found the limit did not apply to web workers — background JavaScript threads — so a local page could start a worker and reach files elsewhere on the machine. Codex had no equivalent restriction at all, so a local page could read files directly. The researchers describe the attack path: a project disguised as a financial report gets the assistant to offer a link to an HTML file, and the page maps folders using macOS .DS_Store files, then pulls SSH keys, .env files and npm tokens.
What is fixed and what is not
Fixed: Cursor (October 1) and Copilot (October 13). Still unpatched, according to the researchers: Codex — reported to OpenAI on July 27 with no response — and VS Code — reported to Microsoft on September 10, which classified it as invalid because it involves a security boundary gated by “workspace trust”. Claude Desktop sits in between: Anthropic rejected Forever’s July 23 report on the same workspace-trust grounds, then accepted a similar report from Noma Security filed a day later; the researchers do not say whether Claude Desktop has since changed, and there is no public version or date for a fix. None of the five flaws has a CVE identifier.
How to lock yours down
First, update Cursor and Copilot now — their fixes are already out. In Codex and VS Code, do not open untrusted local HTML files in the built-in browser; open them in a regular browser instead, or inspect them first. Keep workspace trust switched on, and only open folders you trust. Keep secrets out of project folders where you can — SSH keys, .env files and tokens are exactly what these pages go after. And treat links and files an agent offers you from an untrusted project as untrusted, even when the project looks ordinary. One reassurance: the command-line Claude Code has no embedded browser and was not among the tools tested — the VS Code issue sits in the editor itself, so it affects extensions that use its browser.