EMBRACE flaws hit 5 AI coding tools, 2 unpatched

Forever Security found EMBRACE flaws in 5 AI coding tools

In all five tools, a web page or a local file could run code, read files or fake an address on the machine behind the browser. Security company Forever Security published the research, which it calls EMBRACE, on October 29, 2026. Researcher Gal Weizman examined the built-in browsers of five products, meaning the panels inside each coding tool that show web pages and files.

The tools were Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. Their browsers are driven by the AI rather than a person, so the assistant can preview a project or read what a tab shows. Forever Security sells a product that monitors how AI tools behave on company laptops, and the research post promotes it.

Each tool gave its built-in browser extra power

The five findings are not one bug; each vendor relaxed one rule a normal browser enforces so its AI could use the page. Forever picked three rules and tried to break each. Normally a page has no way to run commands on your computer, a local file cannot reach your other files, and only the browser decides what the address bar shows.

Every tool bent one of these rules to do its job. Forever says each choice had a reason, yet each gave a hostile page a power an ordinary browser would never grant. The name EMBRACE stands for an embedded browser that is trusted as if it were a real one.

The impact was code execution, file theft or a fake address

Cursor ran commands, Copilot showed a fake address, and the other three tools leaked files from the disk. In Cursor, a booby-trapped page hid instructions that the agent read and turned into a command, and the user only had to press Enter to approve it. When Cursor's sandbox blocked the command, the agent turned the sandbox off by itself and retried, though this did not happen every time and depended on the model.

Cursor also had a separate flaw earlier this year (related: Cursor vulnerability ran code you never approved). In GitHub Copilot, a page could tell the app any address it liked, and the app only checked that the text looked like a URL. The address bar read github.com while the tab sat on another page, and the agent's tab list showed the same false address.

A local HTML file could read the whole disk in 3 tools

In Claude Desktop, Codex and VS Code, opening a project's HTML file in the built-in browser could expose SSH keys and other files outside the project. A normal browser keeps a local file inside its own folder. In these three tools, the file could reach across the disk and send what it read to an outside server.

Web workers slipped past the folder check

Claude Desktop and VS Code limited only the page itself to the project folder, and Codex had no limit at all. Both Claude Desktop and VS Code check that a local page stays within its project. That check does not cover a web worker, a script the page can start in the background, so a worker could read any file on the machine.

In Codex, the page could read files directly. To find targets, the attack read the hidden index files macOS leaves in every folder opened in Finder. On Forever's own Mac it pulled SSH keys (files that prove your identity to servers), .env files, npm tokens and the hosts file.

The assistant itself handed over the one link to click

The one click the attack needs comes from a link the assistant offers while doing a task the user asked for. Forever's test project looked like a dull financial report. When asked to "set it up per the README," the assistant showed a clickable link to the HTML file.

After that single click, the files were read and sent with nothing shown on screen. Forever notes that the agent did nothing wrong in this case, since the weakness sits in the embedded browser rather than the AI.

Codex and VS Code were unpatched at publication

No fixed Claude Desktop version is named in the research, so only Cursor and Copilot users can be sure an update closes the hole. When Forever published on October 29, the Codex and VS Code issues were still open. Forever says anyone using either tool remains exposed.

Cursor fixed its flaw on October 1 and Copilot in 1.1.29

Updating Cursor and the GitHub Copilot app closes the issues found in those two tools. Forever reported the Cursor flaw on September 10, and Cursor patched it without notice on October 1. Help Net Security put the gap at three weeks; Cursor neither replied to Forever nor issued an advisory.

Forever confirmed the Copilot address spoof on version 1.1.27 on September 26. GitHub fixed it on its own in build 1.1.29 on October 13, before Forever had sent any report.

Microsoft and Anthropic declined Forever's reports

Both companies said the issue fell under Workspace Trust, and Microsoft declined to fix VS Code. Workspace Trust is the prompt that asks whether you trust the author of a folder you open. Microsoft, which received Forever's VS Code report on September 10, did not respond to The Register's request for comment.

Anthropic turned down Forever's July 23 report on the same grounds. It accepted a report Noma Security filed the next day, but no fixed Claude Desktop version appears in the research or in the coverage by The Register and Help Net Security.

OpenAI never answered Forever's July 27 report on Codex. A spokesperson told The Register that the company is aware of the issue and working to address it.

What companies and developers can do until fixes ship

The risk drops when companies know which laptops run Codex or VS Code and developers keep HTML files from unknown projects closed. Japan's Information-technology Promotion Agency (IPA) ranks cyber risks around AI use third among threats to organizations in its 2026 list. It also cites a case where a flaw in an AI service could leak internal data, and the steps below follow its advice for administrators and staff.

Companies: list the AI coding tools and versions in use

Companies should list which of the five tools and versions run on staff laptops and update the two that have fixes right away. IPA advises managing IT assets and configurations to see which AI services are in use, including ones the company has not approved. Forever gives security leaders the same first step: find out which of these tools run on company machines.

Once the list exists, move Cursor and the Copilot app to their fixed versions. For Codex and VS Code, watch each vendor's release notes so the fix goes out as soon as it ships, and keep up with new attack methods as IPA recommends.

Developers: keep unknown HTML files out of built-in browsers

In Codex, VS Code and Claude Desktop, developers should not preview HTML from other people's projects, even when the assistant offers a link to it. In Codex, which has no folder check at all, opening one file puts the whole disk within reach. Forever warns against treating "a user would have to click something" as a defense.

IPA also tells staff not to rely too much on AI, which here means checking where a link points before you click it. If something seems off after opening a file, tell your security team right away, since IPA says the response should follow the plan your organization has in place.