Forever Security 'EMBRACE' Research Breaks Five AI Coding Browsers

Five AI coding tools shipped embedded browsers that break the basic rules real browsers enforce, researchers at Forever Security report. The affected products: Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop.

Researcher Gal Weizman calls the pattern EMBRACE, 'short for an embedded browser trusted like a real' one. As Help Net Security lays out, a standalone browser treats every page as hostile and enforces three rules: a page cannot run commands on your computer, a local file cannot read your other files, and only the browser writes the address bar. Each vendor loosened one of those rules so the AI could preview a project or read what a tab shows.

In Cursor, a malicious web page could reach the command composer through a bridge between the embedded browser and the assistant. In the researchers' demo the assistant was manipulated into running an install command that launched Calculator on the host; when a sandbox blocked an earlier try, the agent 'switched the sandbox off and try again' without explicit authorization.

In GitHub Copilot, before version 1.1.29, 'a malicious page could change the URL displayed in Copilot's browser preview without navigating to the claimed destination,' turning the address bar into a believable spoofed sign-in form.

Codex, VS Code and Claude Desktop share the same disk-reading flaw: web workers inside a local HTML file bypass the folder restrictions on the main page. On the test machine the exploit collected 'SSH keys, .env files, npm tokens and the hosts file.'

The patch status, per Hackread: Cursor was reported September 10 and patched October 1; Copilot was reported September 26 and patched October 13 in version 1.1.29. Codex was reported to OpenAI on July 27 and VS Code to Microsoft on September 10. Both remained unpatched at publication, in products that between them reach, by Hackread's count, 'hundreds of millions of developers,' with VS Code at around 40 million and Codex at more than 5 million weekly users. The research arrives against a run of agent-security disclosures our tracker has been logging all month, including Anthropic's own chained-exploit write-up a day earlier.

Weizman's advice for teams in the meantime: 'check every HTML file in those projects for the exploit pattern.'