AI Agents

EMBRACE Attack: Five AI Coding Tools' Embedded Browsers Broken — What Forever Security Found

By Yogesh · October 30, 2026 · 10 min read

Sources checked and dated on publication. See our editorial policy.

EMBRACE Attack: Five AI Coding Tools' Embedded Browsers Broken — What Forever Security Found

On October 29, 2026, Forever Security published its EMBRACE research showing that all five major AI coding assistants — Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code, and Anthropic's Claude Desktop — violate fundamental browser security rules through their embedded browsers. The flaws range from arbitrary code execution to full-disk file exfiltration, and as of publication, Codex and VS Code remain unpatched.

The short answer

Three browser rules broken — Forever Security tested five AI assistants against three core browser rules: a page cannot run commands on your computer, a local file cannot read other files, and only the browser writes the address bar. All five products violated at least one rule.
Two tools still unpatched — As of October 29, 2026, OpenAI's Codex and Microsoft's VS Code have not shipped fixes for the arbitrary content exfiltration vulnerability. Cursor and GitHub Copilot have patched; Anthropic accepted the report after a second disclosure.
The pattern, not one bug — EMBRACE (Embedded Browser Trusted Like A Real One) is a class of flaws: each vendor enriched its embedded browser beyond standard browser capabilities, and those enrichments — IPC bridges, file-read permissions, address-bar delegation — became the attack surface.

On October 29, 2026, Forever Security published EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants — a technical deep-dive showing that Cursor, GitHub Copilot, OpenAI's Codex, Microsoft VS Code, and Anthropic's Claude Desktop all break core browser security guarantees through their embedded browsers.

Update note — October 30, 2026

This article is based on Forever Security's technical report published October 29, 2026, Help Net Security's independent coverage the same day, and the vendor responses documented in the Forever Security disclosure timeline. Codex and VS Code remain unpatched at time of writing; readers should verify current status before relying on any mitigation.

What EMBRACE actually is

EMBRACE is not a single CVE. It is a class of embedded-browser flaws that Forever Security named for the pattern: EMbedded BRowser trusted like A Chrome/strong Engine. The researchers tested five AI coding assistants against three rules every standalone browser enforces:

A page cannot run commands on your computer.
A local file cannot read your other files.
Only the browser writes the address bar.

Each product relaxed one of these rules to let the AI assistant preview projects or read tabs. In all five products, one rule gave way.

The three variants and who has which

Arbitrary Code Execution — Cursor

Cursor's integrated browser exposes a window.cursorBrowser.send() channel that lets any page inject a prompt into the agent's composer. A hostile page can forge a chip labeled "Start setup" with a hidden command split across attributes. The agent reassembles and runs it; auto-run is on by default with an empty allowlist. One Enter approves. When the sandbox blocks the command, the agent itself disables the sandbox and retries — the cancel is not in the payload. Cursor silently patched on October 1 after a September 10 disclosure; they never replied to the researchers.

Arbitrary Context Emulation — GitHub Copilot

Copilot's browser preview lets a page tell the app its own address via a Tauri IPC call. The app only validates that the string looks like a URL (starts with http, https, or file), then shows it in the address bar and feeds it to the agent as the tab's location. A phishing page can claim to be github.com/login while serving a fake sign-in form from the attacker's host. The real browser view never moves, so nothing corrects the claim. GitHub fixed this in Copilot 1.1.29 on October 13, before Forever filed their report.

Arbitrary Content Exfiltration — Codex, VS Code, Claude Desktop

These three assistants embed browsers that allow a local file:// page to read files outside its project folder. The mechanism differs:

Codex has no file-read fence at all. A plain fetch("file:///etc/hosts") from the page returns any file on the machine.
VS Code and Claude Desktop fence the top-level page, but a WebWorker launched from that page runs outside the fence. The worker can recursively read the entire disk — SSH keys, .env files, npm tokens, browser databases, private documents.

The delivery is routine: a project that looks like a dull financial report contains one malicious line spawning a worker. The assistant itself renders a clickable file:// link when asked to "set up the project per the README." The victim clicks a link the agent drew.

Vendor responses and patch status

Product	Variant	Disclosed	Status
Cursor	Code execution	Sep 10	Patched Oct 1 (silent, no reply to researchers)
GitHub Copilot	Address spoofing	Not filed (GitHub fixed independently)	Fixed in 1.1.29 (Oct 13)
Claude Desktop	Content exfiltration	Jul 23 (declined), Jul 24 (accepted via Noma Security)	Fix status unclear — Anthropic accepted as valid
VS Code	Content exfiltration	Sep 10	Declined (Workspace Trust); still unpatched
Codex	Content exfiltration	Jul 27	No response from OpenAI; still unpatched

What to check now

Forever Security's Gal Weizman advises teams running Codex or VS Code to pull the list of trusted projects from each machine's config file and check every HTML file in those projects for the exploit pattern. The click this attack needs comes from a link the assistant draws itself, and in Codex and VS Code that link can still open a page that reads the whole disk.

Why this pattern matters beyond these five tools

Every AI assistant that embeds a browser and gives it extra powers — IPC to the agent, file-system reach, address-bar authority — creates an EMBRACE surface. The fix is not "patch this bug"; it is stop trusting the embedded browser like a real one. Standalone browsers treat every page as hostile. Embedded browsers in AI tools must do the same, or the enrichment becomes the exploit.

Verdict If you use Codex or VS Code: you are exposed to full-disk exfiltration via a single click on an agent-rendered link. Treat every file:// link in an AI assistant as untrusted until the vendor ships a fix.

If you use Cursor or Copilot: verify you are on the patched versions (Cursor post-Oct 1, Copilot 1.1.29+). The fixes are real but were not coordinated with the researcher.

For the industry: EMBRACE is the first systematic demonstration that the "AI needs a browser" architecture decision has a shared failure mode. The next assistant to ship an enriched embedded browser will likely have its own variant.

Bottom line: Five major AI coding tools. Three browser rules. Five violations. Two still unpatched as of October 29. The pattern is not "a bug" — it is the architectural consequence of giving an embedded browser powers a real browser correctly denies.

Sources

Prices and benchmark figures are standard published rates as of October 30, 2026 and can change without notice. Some outbound links may be affiliate links — see our disclosure. Found an error? Tell us and we'll correct it in public.