EMBRACE AI coding flaws have exposed a quiet weakness in the tools millions of developers now trust with their code, credentials and computers. Researchers at Forever Security reported on October 29, 2026, that the built-in browsers inside five leading AI coding assistants broke basic browser rules, letting a web page or a local file run code, steal files or fake a website address. Two flaws — in OpenAI's Codex and Microsoft's Visual Studio Code — remained unpatched at publication, leaving a live risk for anyone who opens an untrusted project or previews a local file.

Key Points

• Forever Security researcher Gal Weizman found EMBRACE flaws in Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's Claude Desktop.
• Cursor's code-execution flaw was patched on October 1; Copilot's address-bar spoofing was fixed in build 1.1.29 on October 13.
• Codex and VS Code flaws remained unpatched at publication, and none of the five flaws has a CVE identifier.
• The file-theft flaws could expose SSH keys, .env files, npm tokens and private documents.
• Update Cursor and Copilot, and do not open local HTML files from unknown projects in Codex, VS Code or Claude Desktop.

What Happened

Forever Security published its EMBRACE research on October 29, 2026, after testing the embedded browsers that AI coding assistants use to preview projects, read documentation and check pages while an agent works. EMBRACE is short for EMbedded BRowser. The central claim is simple: each tool gave its built-in browser powers that a normal browser deliberately withholds, and those extra powers broke the traditional security model. A normal browser treats a page as hostile. It cannot run commands on the host computer, a local file cannot read other files on the disk, and only the browser itself writes the address bar. In the five tools tested, at least one of those guarantees failed in each case.

The disclosure, reported by The Register and detailed by Hackread and other security outlets on October 29 and 30, covered three outcomes. Cursor suffered a code-execution flaw, GitHub Copilot an address-bar spoofing flaw, and Codex, VS Code and Claude Desktop a local-file flaw that could read files across the disk. The researchers disclosed four flaws directly to the vendors; GitHub fixed Copilot independently, without receiving a report from Forever Security.

Patch status is the sharpest part of the story. Cursor was reported on September 10 and patched on October 1, but the researchers say the fix arrived without a public notice or a response to their disclosure. Copilot's flaw was found in version 1.1.27 on September 26 and fixed in version 1.1.29 on October 13. Codex was reported to OpenAI on July 27 and VS Code to Microsoft on September 10, and both remained unpatched at publication. Anthropic first rejected Forever Security's July 23 Claude Desktop report as invalid, then accepted the same flaw when Noma Security reported it a day later, according to Weizman. The published reports do not confirm a public fix for Claude Desktop, so it should not be assumed to be patched.

Background and Context

Embedded browsers are everywhere in modern developer tools, and that is why the findings matter. A coding assistant does not just edit text. It previews a project in a built-in browser, follows links an agent suggests and renders a local HTML report. Each convenience quietly extends the browser's reach beyond the sandbox that protects ordinary web browsing. When an assistant treats a page as a trusted helper rather than untrusted content, the page can become an attacker.

Scale compounds the risk. Reporting cited in the coverage puts VS Code at around 40 million users and Codex at more than 5 million weekly users, with the five tools together reaching hundreds of millions of developers. A flaw that looks narrow in a laboratory — one local file, one preview pane, one hidden instruction — becomes a practical attack route as soon as a malicious project, a compromised dependency or a booby-trapped report reaches a developer's machine.

EMBRACE is not a single bug with a single patch. It is a class of weakness, and the researchers argue it comes from a design choice: enriching an embedded browser so it can do more than a real browser, without carrying over the real browser's defences. Cursor enriched the browser's link to the agent, Copilot enriched its control over the displayed address, and the other three enriched a local file's reach onto the host disk. In each case, the enrichment itself created the opening.

EMBRACE AI Coding Flaws: How Embedded Browsers Broke the Rules

In Cursor, the integrated browser lets a web page call the coding agent's composer, where the agent turns instructions into actions. An ordinary web page cannot do that, because its JavaScript cannot communicate with local applications. In the researchers' demonstration, a malicious page hid a command behind a harmless-looking button, and the agent read it as an instruction. The agent was manipulated into running an installation command that launched Calculator on the host system, a standard proof of code execution. When a sandbox restriction blocked an earlier attempt, the agent switched the sandbox off and tried again, without explicit user authorisation, according to the reports. The result was model-dependent and not reliable every time, but the direction — a page steering an agent toward running a command — is the vulnerability itself.

In GitHub Copilot, the flaw was quieter but potentially more deceptive. A page could tell the app which address it was on, because the preview accepted an address supplied by a page when it changed its address without loading a new one. The app checked that the text resembled an address beginning with http, https or file, but did not verify the tab's actual destination. An attacker could therefore display github.com/login in the address bar while loading a fraudulent site beneath it, and the agent's tab list would repeat the false address. A developer who trusted the address bar could be tricked into entering credentials into a fake sign-in form.

In Codex, VS Code and Claude Desktop, a local HTML file opened in the built-in browser could escape the browser's boundaries and read other files. VS Code and Claude Desktop confined a local page to its project folder on the main page, but the restriction did not apply to web workers, background threads that run JavaScript. A local page could start a worker to bypass the limits and reach files elsewhere on the machine. Codex had no equivalent folder restriction, so a local page could read files directly. In the demonstration, the page used macOS .DS_Store files to map folders and collected SSH keys, .env files, npm tokens and the hosts file — exactly the secrets that unlock servers, cloud accounts and code repositories.

Reactions and Quotes

Weizman summarised the root cause in a sentence quoted widely in the coverage: each tool "enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model — as agent input, as the authority on a tab's own address, or as reach onto the host." The three phrases map onto the three failure modes: Cursor treated a page as agent input, Copilot treated a page as the authority on its own address, and the other three treated a local file as having reach onto the host.

The vendors' responses, as reported, were uneven. Cursor patched on October 1 but, according to the researchers, published no security advisory and did not respond to the disclosure. GitHub fixed Copilot in build 1.1.29 on October 13 without receiving Forever Security's report, and did not respond to The Register's request for comment. OpenAI did not respond to the July 27 Codex disclosure, according to the researchers, or to questions about whether it planned a fix. Microsoft classified the VS Code report as an invalid issue involving a boundary gated by "workspace trust", and the flaw remains unpatched, according to the researchers. Anthropic did not respond to The Register's questions about its rejection of Forever Security's report or its acceptance of Noma Security's report the next day.

The "workspace trust" argument is the vendors' main defence, and it deserves explanation. In VS Code and Claude Desktop, local files are supposed to be trusted only when they come from a workspace the user has explicitly trusted. The researchers' point is that a web worker escapes the folder check that enforces that boundary, so the trust decision is not actually enforced where it matters. A user who opens a project and clicks a link the assistant suggests may believe they are inside a trusted workspace, when the file they opened can reach far beyond it.

Why It Matters

EMBRACE matters because it attacks the developer's machine, not just the developer's code. A stolen SSH key or leaked .env file does not stay on one laptop. It can open a production server, a cloud account or a private repository, quietly, long after the preview window has closed. Code execution is worse, because it turns a browsing action into a foothold from which an attacker can run further commands. Address-bar spoofing weaponises trust itself, turning the browser's most familiar safety signal into a lie.

The findings are also a warning about AI agents in general. Agents are designed to act on what they read, and that is their value. But when an agent reads a web page, a local file or a project report, it cannot always tell an instruction from its user apart from one planted by someone else. Cursor's flaw is a concrete example of that confusion, sometimes called prompt injection. As agents gain more tools — file access, terminal access, cloud credentials — the cost of that confusion rises, and a browser that treats pages as hostile is one of the oldest defences against it.

What Happens Next

The immediate advice is practical. Update Cursor to a version containing the October 1 fix, and update GitHub Copilot to build 1.1.29 or later. Do not open local HTML files from unknown projects in Codex, VS Code or Claude Desktop, even if the assistant itself suggests the link. Treat any HTML file inside an unfamiliar repository, a downloaded project or a generated report as untrusted content, not a safe preview. Developers handling production credentials should consider rotating any SSH keys, tokens or secrets that may have been exposed through a local-file preview.

Pressure will now fall on OpenAI and Microsoft to publish fixes and clear statements for Codex and VS Code, and on Anthropic to clarify Claude Desktop's status after the Noma Security report. Security teams will watch for CVE assignments, vendor advisories and updated builds. Until those arrive, the safest assumption for Codex and VS Code users is the researchers' own: the flaw is still present.

Frequently Asked Questions

What is EMBRACE?

EMBRACE, short for EMbedded BRowser, is the name Forever Security gave to a class of flaws in the built-in browsers of five AI coding tools, where each browser was given powers beyond those of a normal browser.

Which tools are affected?

Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's Claude Desktop. Cursor allowed code execution, Copilot allowed address-bar spoofing, and the other three allowed local files to read files across the disk.

Which flaws are still unpatched?

According to the researchers, Codex and VS Code remained unpatched when the findings were published on October 29, 2026. Cursor was patched on October 1 and Copilot in build 1.1.29 on October 13. No public fix for Claude Desktop is confirmed in the published reports.

What could an attacker steal?

In the demonstration, the researchers collected SSH keys, .env files, npm tokens and the hosts file — secrets that can unlock servers, cloud accounts and private repositories.

What should developers do now?

Update Cursor and Copilot, avoid opening local HTML files from unknown projects in Codex, VS Code or Claude Desktop, and rotate any credentials that may have been exposed through an untrusted preview.

Related coverage on US News Pulse: Anthropic IPO filing, Meta's $95 billion AI raise and Trump's AI executive order.