What happened
Forever Security (Gal Weizman) published EMBRACE on 2026-10-29, demonstrating that in all five AI coding assistants a hostile web page or local file reaches the machine behind the embedded browser. Cursor allowed agent code execution, Copilot allowed address-bar spoofing, and Codex/VS Code/Claude Desktop allowed a single local file to read the whole disk. Anthropic and Microsoft declined or ignored the reports citing Workspace Trust, which the researcher notes provides no real protection since users just click 'Trust'.
Why it matters
AI coding assistants embed a trusted browser to preview projects, but that browser is a security boundary the vendor broke to give the agent conveniences. Because these tools run with the developer's full privileges and hold AI-provider and cloud credentials, a one-click local-file read or command execution lets an attacker steal the exact secrets an AI agent is trusted with. Two of five vendors shipped no fix, so the exposure is live today for the two most-widely-deployed tools.
Attack vector
A project is dressed up as a benign doc; the developer clicks the assistant's link to a local HTML file. The embedded browser is trusted like a real browser, but the folder-containment check covers only the main page — a spawned web worker (or, in Codex, no check at all) escapes it and reads arbitrary files, fingerprinting the disk via macOS Finder index files and exfiltrating SSH keys/.env/npm tokens. In Cursor a crafted page injects a command the agent executes (model-dependent), and in Copilot the address bar can be spoofed to github.com/login over a phishing form.
Affected systems
Embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. Patched: Cursor (Oct 1) and Copilot 1.1.29 (Oct 13). UNPATCHED as of 2026-10-29: OpenAI Codex and Microsoft VS Code.
Mitigation
Codex and VS Code remain unpatched. Audit each machine's trusted-project list and scan every HTML file in trusted projects for the exploit pattern; restrict the embedded-browser origin and disable Workspace-Trust bypasses. For Copilot and Cursor, upgrade to the fixed versions.