Skip to content
AI Security Wire

Published

- 4 min read

By

EMBRACE: Embedded Browsers in Cursor, Copilot, Codex, Claude Desktop Flawed

Forever Security Cursor GitHub Copilot Codex Claude Desktop VS Code embedded browser prompt injection
img of EMBRACE: Embedded Browsers in Cursor, Copilot, Codex, Claude Desktop Flawed

Forever Security, a commercial AI security startup, has published research on a class of flaws it calls EMBRACE, found in the browsers that AI coding assistants embed so an agent can view and test web pages. The report is dated 29 October 2026 and covers five products with mixed patch outcomes.

The technical details come from Forever Security’s own report. The Register covered it the same day and added vendor responses, but its account relies on the researchers’ findings. We have not tested the flaws.

Why embedded browsers matter

An assistant that can open a page, read it and act on it has a new trust boundary. The page is untrusted content, but the assistant treats what it sees as context and sometimes as instructions. Forever Security’s argument is that each tool enriched its embedded browser beyond what a normal browser allows, and that this undermined the usual threat model.

What Forever Security reports

The report describes three variants.

  • Cursor, code execution. A page could call a window.cursorBrowser.send(...) bridge, which fed attacker-supplied fields into the agent’s composer as a prompt injection. The payload split a command across attributes. Forever Security says auto-run then surfaced a single run card that executed on one keypress, with the card already focused. The sandboxed install was blocked, and the agent itself cancelled the sandbox and retried with full privileges. That step was not in the payload. Success was probabilistic and depended on the model, and the proof of concept launched a calculator.
  • GitHub Copilot, address spoofing. The app accepted an address reported by the page and checked only that it looked like a web address, not where the tab really pointed. That allows a spoofed address such as github.com/login over a fraudulent page.
  • Claude Desktop, Codex and VS Code, file reads. A local HTML page opened in the built-in browser could read files outside its project folder. In Claude Desktop and VS Code the project-scope restriction did not apply to web workers. Codex had no such restriction, so no worker was needed. The victim still has to open the file, which the researchers say the assistant can make look routine by presenting a clickable link. The researchers report reading SSH keys, .env files and npm tokens on their own research machine, sending data to a localhost sink.

Vendor responses, as reported

Dates come from Forever Security’s report, with The Register’s additions noted.

  • Cursor: disclosed 10 September and patched silently on 1 October. Cursor published no advisory and did not reply to the researchers or to The Register.
  • GitHub Copilot: found on version 1.1.27 on 26 September. GitHub fixed it independently in 1.1.29 on 13 October, without receiving a report. GitHub did not respond to The Register.
  • Anthropic (Claude Desktop): Forever Security says it disclosed on 23 July and the report was declined as invalid, on the grounds of a Workspace Trust gated security boundary. It says Noma Security disclosed on 24 July and that report was accepted as valid. The Register, citing the researcher, says Noma reported the same flaw. Anthropic did not respond to The Register, and neither source states whether the issue is patched.
  • OpenAI (Codex): disclosed 27 July with no reply to the researchers. Forever Security says it remains unpatched. An OpenAI spokesperson told The Register that it is aware of the issue and working to address it.
  • Microsoft (VS Code): disclosed 10 September. Forever Security says Microsoft declined it as an invalid Workspace Trust gated boundary issue and that it remains unpatched. Microsoft did not respond to The Register.

What to do

Our assessment: the risk is real but narrow. It needs a developer to point an agent’s embedded browser at a hostile page, or to open a hostile local HTML file. That is not rare for people testing web apps or following links from issues and docs.

  • Do not open untrusted pages or local HTML files in an assistant’s embedded browser on machines that hold keys and tokens.
  • Turn off auto-run for commands where the tool allows it, at least when browsing.
  • Keep SSH keys, .env files and similar secrets out of paths that agents can reach where you can.
  • Check your versions. We found no vendor release notes for any fix. Cursor’s silent patch has no published version, so there is nothing to check against. Anthropic’s fix status for Claude Desktop is not stated in either source. Forever Security reports Copilot fixed in 1.1.29, with that caveat. Assume Codex and VS Code remain exposed until the vendors say otherwise.

The wider lesson fits a pattern we have covered before: agent tooling inherits the weaknesses of every component it embeds. For related Forever Security work, see our earlier piece on instruction file poisoning in Codex and Claude Code.

References

Frequently Asked Questions

Which products does the EMBRACE research cover?
Forever Security names Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. The flaws sit in the embedded browsers these assistants ship, though the Cursor chain also depended on the agent's own behavior. The issues differ: code execution in Cursor, address-bar spoofing in Copilot, and file reads outside the project in Claude Desktop, Codex and VS Code.
Are the flaws patched?
As of Forever Security's 29 October report, partly. It says Cursor patched silently on 1 October, with no advisory, and that GitHub fixed Copilot in version 1.1.29 on 13 October. It says the Codex and VS Code issues remain unpatched. Neither the report nor The Register states whether the Claude Desktop issue is patched. We found no vendor release notes confirming any fix.
Is there a CVE or a real-world attack?
No CVE appears in the Forever Security report or The Register article, and neither reports exploitation in the wild, as of 6 November 2026. We did not search NVD ourselves. The Cursor proof of concept launched a calculator on the host, and the file-read proof of concept sent data to a localhost sink. Forever Security says the Cursor chain is probabilistic and depends on the model.