EMBRACE: Five AI Coding Tools Broke Every Promise a Browser Makes - and Codex and VS Code Are Still Unpatched

The preview pane inside your AI coding assistant looks like a browser, and most developers assume it carries a browser's protections. A security researcher spent the autumn proving that assumption wrong, one tool at a time. On October 29, Forever Security published EMBRACE, research by Gal Weizman covering the embedded browsers in five of the most widely used desktop AI tools: Cursor, GitHub Copilot, OpenAI's Codex, Visual Studio Code and Anthropic's Claude Desktop. The Register covered the disclosure the same day.

A real browser keeps three promises: a web page cannot run programs on your machine, a local file opened in the browser cannot read your other files, and only the browser itself writes the address bar. EMBRACE is the shorthand Weizman gave to a class of failures where an embedded browser was trusted as if it kept those promises, when it did not. Each of the five tools broke at least one of them, through five different defects rather than one shared bug. None of the issues had received a CVE identifier at publication.

Cursor broke the first promise in the most agentic way possible. A malicious web page could push text into the coding agent's composer through a bridge object called window.cursorBrowser.send, invisible to the user. With auto-run enabled, a single Enter keypress executed a command, and in the researchers' demonstration the agent launched the Calculator app by installing a malicious package - and even disabled its own sandbox when it got blocked. The behavior was model-dependent, so it did not fire on every attempt. Forever Security reported it on September 10; Cursor silently patched it on October 1 without publishing an advisory or replying to the researchers.

GitHub Copilot broke the third promise. Up to version 1.1.27, a page could set the embedded browser's address bar to any URL it liked, so a phishing form could display github.com/login while actually being served from an attacker-controlled site. In an unusual twist, GitHub had already fixed the issue independently in version 1.1.29 on October 13, before Forever Security ever filed the report.

The broadest failure hit Codex, VS Code and Claude Desktop at once: a local HTML file opened in the preview pane could read files outside the project folder. VS Code and Claude Desktop confined the page itself but forgot that web workers it spawns run outside that check, while Codex applied no folder restriction at all. The researchers demonstrated reads of SSH keys, .env files and npm tokens. The attack needs a single click, and the researchers showed a path where a project README leads the assistant to write a clickable file:// link to a booby-trapped page.

The vendor responses are as revealing as the bugs. Microsoft declined the VS Code report, calling it a Workspace Trust matter rather than a product vulnerability, and it remained unpatched as of October 29. OpenAI did not respond to the July 27 Codex report, according to Forever Security, but told The Register it is aware of the issue and working on a fix. Anthropic initially declined the Claude Desktop report, citing Workspace Trust, then accepted a same-class report from Noma Security dated July 24 - leaving Claude Desktop in an ambiguous state with no fix version published.

The takeaway goes beyond patch hygiene. In an agentic tool, a web page is not just content to render - it is input to a model that can act on what it reads, with the permissions of the desktop app wrapped around it. Until fixes ship, the practical guidance is unglamorous: update Cursor and Copilot to current builds, keep workspace trust in restricted mode for anything unfamiliar, and open untrusted HTML in a standalone browser, which is still the only component that actually enforces the boundary between a page and your files.