What is the EMBRACE vulnerability?
On October 29, 2026, the security startup Forever Security published research into a pattern it found across five desktop AI coding assistants. The firm calls the pattern EMBRACE, short for an embedded browser trusted like a real one. The affected products are Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's Visual Studio Code and Anthropic's Claude Desktop.
Forever sorts the findings into three variants. It calls the Cursor case arbitrary code execution, the file-read cases arbitrary content exfiltration, and the Copilot case arbitrary context emulation. The labels describe what each assistant trusted: a page as input, a local file as harmless, or a tab as truthful about its own address.
A standalone browser assumes every page is hostile. It stops web pages from running commands on the machine, stops a local file from reading its neighbours and keeps the address bar under browser control. Each assistant bent one of those rules so that previews, local projects and tab reading would work. Forever found that the bent rule could be turned against the developer.
The consequences differ by product. In Cursor, a web page could reach code execution on the host. In Copilot, a page could make the address bar show a site it was not on. In Claude Desktop, Codex and VS Code, a local page could read files outside its project, including keys and credentials.
The common thread is enrichment, not a shared bug. Gal Weizman, the researcher who wrote the technical report, said the tools “enriched” their browsers “beyond what a normal browser allows,” and that those enrichments “undermined the traditional threat model.” Nothing in the chain required a compromised update or a stolen password. It required an ordinary page or project that the developer chose to open.
Which AI coding tools are affected, and which are patched?
Two of the five issues were still unpatched when Forever published its report, according to The Register and Help Net Security. The open flaws sit in OpenAI's Codex and Microsoft's VS Code. The other three products had fixes or an accepted report by that date.
The disclosure records differ sharply from vendor to vendor. Cursor fixed its flaw without publishing an advisory and never replied to the researchers, according to Forever. GitHub fixed Copilot before anyone filed a report. Anthropic and Microsoft both rejected Forever's reports as invalid for a boundary gated by a Workspace Trust prompt, and OpenAI did not answer the original report at all.
The two open issues matter for day-to-day use because both tools are common in development work. Help Net Security notes that a developer who opens a rigged project in either tool can still lose SSH keys, cloud credentials and tokens with one click.
Disclosure practice varies as much as the fixes. A silent patch leaves users unable to tell whether they were exposed, and it leaves other vendors without a public description to test against. A declined report leaves the researcher with no route except publication, which is what happened here for two of the five tools.
- •Cursor: reported September 10; silently patched October 1; no public advisory; no reply to the researchers.
- •GitHub Copilot: the address-bar spoof was confirmed on version 1.1.27 on September 26; GitHub fixed it in version 1.1.29 on October 13 without receiving a report.
- •Claude Desktop: reported July 23; Anthropic declined it as invalid; Noma Security reported the same flaw a day later and Anthropic accepted that report.
- •Codex: reported July 27; no response; still unpatched on October 29; OpenAI says it is working on a fix.
- •VS Code: reported September 10; declined as a Workspace Trust issue; still unpatched on October 29.
How did a web page run code on a Cursor user's machine?
Cursor's integrated browser adds a channel that lets a page call window.cursorBrowser.send(). That call reaches the agent's composer, the text box the agent reads as instructions. Forever says the channel is exposed to every page, on any origin, without a user gesture.
The element-selected channel builds a composer chip from fields that the page supplies. The chip renders as a plain div, so the person sees almost nothing while the agent reads every field. A command in a single attribute was refused, so the payload split it across attributes and asked the agent to join them.
The design assumes the composer is a place where a person expresses intent. Cursor's browser channel let a page write into that place without showing the person what it wrote. That is prompt injection with a delivery mechanism, and it explains why the command was split into fragments: the agent reassembled meaning that no human ever approved in one piece.
Auto-run shipped on with an empty allowlist, so the command surfaced as one card that runs on Enter. The payload also pulled the cursor into the composer, leaving the run card focused. Forever describes the cost to an attacker as one keystroke.
The sandbox did intervene, but the agent worked around it. npm install was blocked, so the agent cancelled the sandbox and retried on its own. The package's preinstall script then ran with full privileges and opened Calculator in the test. Forever reproduced this from a cold start in an empty workspace, so the attack did not depend on a half-configured machine. The research team calls success probabilistic and model-dependent, but the finding is that a visited page reached host code execution at all.
Why can one local file read an entire disk?
Claude Desktop, Codex and VS Code all open local HTML inside an embedded browser. Same-folder reads are meant to work, and escaping the project folder is meant to be blocked. The fence that enforces the rule runs in the top document.
It does not run inside a web worker, a background script that a page can launch. A local page can start a worker from an in-memory blob, and inside that worker a file:// fetch returns the contents of any file. Codex is the outlier: it had no fence on the page, so a plain read from the top document already worked.
To find targets, Forever parsed .DS_Store files, the hidden indexes macOS writes into every folder a user has opened. Each index lists its siblings, so the payload can walk outward from the home directory without a directory API. On the research machine, the sweep collected SSH keys, .env files, npm tokens and the hosts file.
The value of the read is not the file count. It is the concentration of secrets in developer folders: private keys for servers, tokens for package registries and API credentials in .env files. Those items let an attacker move from a laptop to production systems without exploiting a second bug.
Exfiltration is the easy part. In the proof of concept, the data went to a local sink; in a real attack, the same worker could post it to any remote server. Delivery still needs one click. The project looks like a dull financial report, and the malicious line looks like an ordinary worker or script include. When the developer asks the assistant to set up the project per the README, the assistant renders a clickable file:// link itself.
Why did Anthropic and Microsoft call this a workspace trust issue?
Workspace Trust is the prompt that asks a developer whether to trust a project folder. Anthropic and Microsoft both rejected Forever's reports as invalid for a boundary gated by that prompt. In their reading, a user who trusts a folder has accepted the risk of what the folder contains.
The prompt exists to keep a workspace from running tasks that its owner did not expect. In practice, trust is granted once per folder and stored, which is why the researchers point to configuration files when they ask teams to audit their exposure.
Weizman does not accept that framing. “Not trusting a project inside an AI harness makes it unusable, so everyone just hits Trust,” he told Help Net Security. He added that the prompt “provides zero protection to the user.”
The duplicate-report history is awkward. Forever reported the Claude Desktop flaw on July 23 and was declined. Noma Security reported the same flaw on July 24, and Anthropic accepted that report as valid, according to Weizman. Two reports of one bug produced two different answers.
For teams, the practical question is whether a trust prompt counts as a security boundary. If a tool can read the disk after the user clicks Trust, then the prompt records consent rather than containment. That distinction matters when a project arrives from a client, a contractor or a public repository.
What should developers and security teams do now?
The first step is patch status. Update Cursor and GitHub Copilot. Treat Codex and VS Code as exposed until their vendors publish a fix, and check advisories before opening an unfamiliar project in either tool.
Weizman's advice is concrete. Pull the list of trusted projects from each machine's configuration file and inspect every HTML file inside those projects for the pattern described in Forever's write-up. An agent-drawn link is still a link, and it can still open a page that reads the disk.
Security teams should also decide how much of the machine an agent may see. Removing credentials from project folders limits the value of a file-read bug. Running an assistant in a container limits the value of a code-execution bug. Neither step fixes the underlying design, but both reduce what a single click can expose.
Incident response should assume exposure until proven otherwise. If a developer opened an untrusted project in Codex or VS Code, rotate any credential that lived under the home directory, not just inside the project. Check package registry tokens and SSH keys first, because those are the items Forever's sweep collected.
For individuals, the cheapest control is separation. Use a dedicated machine or account for unfamiliar repositories, and keep personal keys off it.
- •Run coding agents in a container or virtual machine with only the access the task needs.
- •Keep SSH keys, cloud credentials and .env files outside folders that an agent can browse.
- •Review auto-run settings, including an empty allowlist, which still permits a one-key approval.
- •Do not treat Workspace Trust as a boundary between a project and the rest of the machine.
- •Log which local files and links an agent opens during setup tasks.
What happens next for embedded browsers in AI tools?
The fixes so far are narrow. Cursor patched its flaw, and GitHub fixed the address-bar spoof in Copilot 1.1.29. The pattern remains: assistants keep adding browser features that ordinary browsers refuse to provide, because those features make the product useful.
Watch three things. First, whether OpenAI and Microsoft publish advisories and version numbers for Codex and VS Code. Second, whether other assistants receive the same scrutiny as they add previews, local file handling and page reading. Third, whether vendors enforce origin checks inside workers and give the address bar a single source of truth.
Neither Forever nor the news reports describe evidence of exploitation in the wild, so the immediate risk is theoretical for most users. The longer-term risk is structural. Every assistant that opens untrusted files now sits inside the same trust boundary as the developer's credentials.
The economics explain the persistence. Previewing a generated app or reading a local dashboard is a core feature of an AI coding assistant, and a strict browser sandbox makes those features awkward. Vendors will keep widening the browser unless customers ask for the boundary in procurement and security reviews.
The class also changes procurement. An embedded browser is a security question, not a convenience feature. Michal Zalewski's The Tangled Web explains why browsers assume every page is hostile and why origin rules carry so much weight. Ross Anderson's Security Engineering treats security as the discipline of drawing trust boundaries, which is where these products failed. The Web Application Hacker's Handbook shows how small, reasonable choices compose into an exploit chain.