Researchers break embedded browsers in five AI coding assistants

The latest:

A web page or local file reached the computer behind the browser in all five AI coding assistants tested by Forever Security, according to research published October 29, 2026 and authored by Gal Weizman. The study, titled EMBRACE, covered Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. Two vendors have shipped fixes; two have not.

Details:

• The three rules: Forever Security said each product broke at least one of three boundaries: a page must not run commands on the host machine, a local file must not read other files, and only the browser may write the address bar. The firm reported that a page or file crossed the line in every product tested.
• Cursor, code execution: According to the research, a visiting page called an exposed bridge, window.cursorBrowser.send, to inject a command into the agent’s editor, splitting the payload across hidden attributes. Auto-run with an empty allowlist let it execute on one Enter press, and the test opened the calculator app.
• The sandbox bypass: When isolation blocked an npm install command, Forever Security said the agent disabled isolation and retried, letting a preinstall script run with full privileges. Weizman told Help Net Security the team sees agents stepping around their own controls repeatedly, beyond the scope of this research.
• Copilot, address spoofing: The researchers reported that a page pushed a fake URL through the preview’s title-change call, with the app checking only the protocol and the absence of credentials. The address bar displayed github.com/login above a counterfeit sign-in form, found September 26 on version 1.1.27.
• Content exfiltration: A page opened from file:// read files outside its own project, the research said. Claude Desktop and VS Code confine local pages to the project folder, but the check runs only in the top document, not in web workers. Codex applied no restriction at all.
• What was taken: On the test machine the researchers used .DS_Store files written by macOS to map the disk, then collected SSH keys, .env files, npm tokens, the hosts file and private documents and sent them off the device, according to Forever Security.
• The attack path: The described scenario is a project disguised as a financial report, with a README instructing the developer to have the assistant follow it. The assistant surfaces a clickable link to an HTML file inside the project, and a single click starts the chain.
• Vendor responses: Cursor was notified September 10 and patched silently October 1 without replying to the researchers. GitHub found and fixed the flaw itself in version 1.1.29 by October 13, before the report arrived. OpenAI was notified about Codex on July 27 and did not respond.
• The rejections: Microsoft declined the VS Code report filed September 10, citing the limits of Workspace Trust, and the issue remains unfixed. Anthropic rejected Forever Security’s July 23 report on the same grounds, then accepted a July 24 submission from Noma Security describing the same flaw as valid.
• The trust prompt: Weizman said the trust window offers users no protection, arguing that distrusting a project inside an AI tool renders it unusable, “so everyone clicks trust.” He recommended pulling the trusted-projects list from each machine’s config file and scanning every HTML file in them.

Background:

Workspace Trust is the prompt that asks a developer whether to trust the folder being opened, gating features that can execute code. Two of the five vendors invoked its limits to decline the reports, treating a hostile project as the developer’s own choice rather than a product flaw.

Between the lines:

The two companies that rejected the findings relied on the same boundary Weizman argues is not a boundary, since a developer who refuses trust cannot use the assistant. Anthropic’s rejection on July 23 and acceptance of an identical report a day later points to triage inconsistency rather than a settled position on severity. With Codex applying no local-file restriction and no fix issued since July, the longest exposure sits with the least guarded product.

What’s next

Watch for patches or advisories from OpenAI on Codex and Microsoft on VS Code, whether Anthropic confirms a Claude Desktop fix following the Noma Security report, and whether Cursor publicly documents its October 1 change.