Gal Weizman, a security researcher at cybersecurity company Forever Security, has identified a class of security flaws dubbed EMBRACE (EMbedded BRowser, trusted like a real one) in five AI coding tools.
Shared with Hackread.com ahead of its public release on October 29, the research identifies weaknesses in browser security controls integrated into Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code (VS Code) and Claude Desktop.
The potential reach is noteworthy, with Forever Security estimating that hundreds of millions of developers and users could be affected since VS Code has around 40 million developers and Codex has more than 5 million weekly users.
Three Ways Embedded Browsers Can Be Abused
- Cursor: Code execution. A malicious web page can exploit a communication bridge between Cursor’s embedded browser and its AI assistant to inject hidden instructions into the command composer. In testing, the assistant was manipulated into running an installation command that launched Calculator on the host system. The command initially hit a sandbox restriction, but the agent disabled the restriction and retried. The outcome depended on the model’s behavior.
- GitHub Copilot: Address-bar spoofing. In version 1.1.27, a malicious page could change the URL displayed in Copilot’s browser preview without navigating to the claimed destination. The address bar and AI agent could therefore report github.com/login while displaying a page hosted by an attacker, creating an opportunity for phishing.
- Codex, VS Code and Claude Desktop: File theft. Researchers found that local HTML files opened in these applications could access files beyond their intended project boundaries. In VS Code and Claude Desktop, web workers could bypass directory checks enforced on the main page. Codex lacked the relevant restriction, allowing direct file access. They demonstrated reading and exfiltrating files, including SSH keys, developer tokens and private documents.
Disclosure Timeline and Patch Status
Forever Security reported the Cursor flaw on September 10; it was patched on October 1. GitHub independently fixed the Copilot issue in version 1.1.29 on October 13, after the flaw was identified on September 26.
Researchers reported the Codex issue to OpenAI on July 27 and the VS Code issue to Microsoft on September 10. According to Weizman, neither issue had been patched at the time of publication.
The findings show how embedded browsers can expose developer systems to code execution, local file theft and address-bar spoofing when security boundaries are not properly enforced.
Hackread.com has previously reported on related risks, including attacks that use hidden website instructions to manipulate AI assistants and browser extensions to inject prompts into AI interfaces.
Businesses should note that a single developer endpoint running an affected tool could expose accessible SSH keys, cloud credentials, developer tokens and source code, or allow code execution on the host, depending on the product involved.
Forever Security advises organizations to identify these tools across developer endpoints and review the security controls governing their embedded browsers.
