Researchers Flag Embedded Browser Flaws in Five AI Coding Tools; Codex and VS Code Still Unpatched
Forever Security's EMBRACE research shows the built-in browsers of Cursor, Copilot, Codex, VS Code and Claude Desktop violate core browser security rules, with two vendors yet to patch.
Security researchers at Forever Security have published EMBRACE, a cross-vendor study describing how five popular AI coding assistants — Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop — embed real browsers whose core security rules are stripped away. The published impacts range from arbitrary code execution to local file exfiltration: in a Cursor demo, a web page injected hidden instructions into the agent composer, prompting the agent to disable its own sandbox and retry; in Claude Desktop, Codex and VS Code, local file:// pages could read arbitrary files, with demo exploits harvesting SSH keys, .env files and npm tokens. GitHub Copilot versions before 1.1.29 allowed address-bar spoofing visible to both humans and agents.
Cursor was patched silently on October 1 and Copilot on October 13. As of publication on October 29, the Codex and VS Code flaws — reported on July 27 and September 10 respectively, with Microsoft declining on Workspace Trust grounds — remained unpatched. The researchers estimate VS Code has around 40 million users and Codex more than 5 million weekly.