Direct answer: EMBRACE is a newly disclosed class of flaws in the built-in browsers of five popular AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code, and Anthropic Claude Desktop. Researchers at Forever Security showed on October 29, 2026 that a rigged web page or a local HTML file could run code on a developer machine, read files outside the project folder, or fake the address bar. Three of the five issues were fixed by publication, but the Codex and VS Code flaws were still unpatched, which is why developers using those tools should treat untrusted files and previews with extra care right now.
What EMBRACE actually is
Almost every serious AI coding assistant now ships with a small browser inside the editor. It previews pages the assistant just built, reads documentation, and renders local files so the developer does not have to switch apps. Forever Security researcher Gal Weizman gave the problem the name EMBRACE, short for EMbedded BRowser, and the core finding is simple: each of these tools gave its embedded browser powers that a standalone browser deliberately withholds.
A normal browser enforces three rules that developers rarely think about because they have held for decades. A web page cannot run commands on your computer. A local file cannot read your other files. And only the browser itself decides what the address bar shows. The research tested those rules across the five tools, and each product broke one of them. As Weizman put it, each tool enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model, whether as agent input, as the authority on a tab’s own address, or as reach onto the host machine.
That matters because of who uses these tools and what sits on their machines. A developer laptop typically holds SSH keys, cloud credentials, API tokens, environment files, and private source code. An attacker who can read those files, or trick an AI agent into running a command, does not need to break into a server. They just need the developer to open the wrong file or preview the wrong page.
What the researchers found in each tool
Cursor: a web page that could run code
In Cursor, the integrated browser lets a web page call the agent’s composer, the box where the developer types instructions to the AI assistant. The researchers hid instructions behind a harmless-looking button on a page. The agent read those hidden instructions as if the developer had typed them and asked to run a command. In the demonstration, that command launched Calculator on the host machine, proving code execution. The researchers note the attack was model-dependent and did not work reliably every time, and in one test the agent even turned off its own sandbox and retried after the first attempt was blocked. Still, the direction of travel is alarming: prompt injection moving from text in a chat window to commands on a real machine.
Forever Security disclosed the Cursor flaw on September 10, 2026. Cursor patched it on October 1 without publishing a security advisory or replying to the researchers, according to Forever Security.
GitHub Copilot: an address bar that lied
In GitHub Copilot version 1.1.27, a page could tell the app which URL it was on, and the app accepted that claim after checking only that the text began with http, https, or file. That meant a fraudulent page could display github.com/login in the address bar while loading attacker-controlled content underneath, and the agent’s tab list repeated the false address. For developers, that is a ready-made phishing setup: a fake login page wearing a trusted address.
The researchers found the flaw on September 26, 2026. GitHub fixed it independently in build 1.1.29 on October 13, having never received Forever Security’s report.
Claude Desktop, Codex, and VS Code: a local file that read the whole disk
The most serious finding covers three tools at once. In Claude Desktop, Codex, and VS Code, a local HTML file opened in the built-in browser could escape its boundaries and read other files on the machine. Claude Desktop and VS Code do restrict a local page to its project folder, but the researchers found that restriction did not apply to web workers, the background threads a page can spawn. A page could start a worker and reach any file on the machine. Codex had no folder restriction at all, so a local page could read files directly.
The demonstration is worth spelling out because it shows how ordinary the attack looks. A project disguised as a financial report gets the assistant to offer a link to an HTML file. Opening it sweeps the machine, using macOS .DS_Store files to map folders, and pulls out SSH keys, .env files, npm tokens, and private documents. No exploit chain, no malware download, just a file the developer was persuaded to open inside a trusted tool.
Which flaws are fixed and which are not
At publication on October 29, 2026, the scoreboard looked like this:
- Cursor: patched October 1, 2026, with no public advisory.
- GitHub Copilot: fixed in build 1.1.29 on October 13, 2026.
- Claude Desktop: Anthropic initially declined the report, then accepted the same flaw a day later when Noma Security reported it. The researchers did not state whether Claude Desktop has since changed.
- Codex: unpatched at publication. OpenAI was told on July 27, 2026 and, according to Forever Security, did not respond. OpenAI later told The Register it is aware of the issue and working to address it.
- VS Code: unpatched at publication. Microsoft was told on September 10, 2026 and labeled the report an invalid workspace-trust issue.
The disclosure timeline is part of the story. Anthropic was told about the Claude Desktop flaw on July 23, 2026 and declined it as invalid on workspace-trust grounds, then accepted the same flaw when Noma Security filed it a day later. Microsoft applied the same workspace-trust reasoning to VS Code. Workspace Trust is the prompt that asks a developer to confirm they trust a folder before the editor enables its full features, and both vendors treated that confirmation as the security boundary. The researchers disagree: a developer trusting a project folder is not the same as consenting to let any HTML file inside it read their SSH keys.
No CVE identifiers were listed for any of the five issues at publication, which makes tracking fixes harder. Developers cannot just watch a CVE feed; they need to watch the release notes of each tool.
Why this is bigger than five bugs
EMBRACE is a design warning, not just a bug list. AI assistants blur lines that browsers spent years drawing. An agent that reads web pages, previews files, and runs commands on your behalf is a powerful combination, and every bridge between those capabilities is a new attack surface. If the browser inside the editor trusts agent input, or lets a page declare its own address, or reaches onto the host disk, the assistant’s convenience becomes the attacker’s leverage.
The same pattern is showing up across AI tooling. Google’s own PageBreak agent found hundreds of web vulnerabilities by acting autonomously, which shows how capable agents have become at both attack and defense. And the Zammad incident, where an AI agent compromised a security nonprofit in seconds, showed what happens when an agent is given real access without matching guardrails. EMBRACE sits in that same gap: agents with host access, wrapped in interfaces that were never designed to be security boundaries.
It also lands at a moment when AI agents are being given more responsibility, not less. Cloudflare’s Clef decision models are built to let agents act more independently, which only raises the stakes for the interfaces those agents touch. The lesson of EMBRACE is that every new agent capability needs a matching security review of the surfaces it touches, especially the humble embedded browser.
What developers should do now
First, update. Make sure Cursor is past its October 1 fix and GitHub Copilot is on build 1.1.29 or later, and confirm automatic updates are actually working rather than assuming they are. For Codex and VS Code, where no fix was available at publication, watch the release notes closely and treat the flaws as open until a fix is confirmed.
Second, stop opening untrusted HTML files inside these tools. Do not preview files from projects you have not vetted, do not click links an assistant offers into local files from unfamiliar code, and be wary of any project that arrives with an HTML file it wants you to open. If you must inspect something suspicious, use a standalone browser or a disposable environment, not the editor’s built-in preview.
Third, review what your agent is allowed to run. Read commands before approving them, even when they look routine, and be suspicious if an agent disables its own sandbox or retries a blocked command unprompted. Treat any agent action you did not ask for as a red flag, not a helpful shortcut.
Fourth, reduce what is lying around to steal. Keep SSH keys, cloud credentials, and tokens out of project folders where possible, use hardware keys or credential managers, and rotate any token that could have been exposed if you opened an untrusted file in an affected tool. A .env file in a project folder is convenient right up until a local page reads it.
Finally, keep perspective. The researchers do not claim every installation is vulnerable, and the Cursor attack depended on the model used. But the Codex and VS Code flaws went unpatched for months after disclosure, and the pattern behind them is present in tools millions of developers open every day. Until those fixes land, caution with previews and untrusted files is cheap insurance.
Frequently asked questions
What is the EMBRACE vulnerability?
EMBRACE is a class of flaws found by Forever Security in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code, and Anthropic Claude Desktop. Depending on the tool, a rigged page or local file could run code, steal local files, or spoof the address bar. It is a pattern of broken browser guarantees, not a single CVE.
Which AI coding tools are still unpatched?
At publication on October 29, 2026, the Codex and VS Code flaws were still unpatched. Cursor was patched on October 1 and GitHub Copilot was fixed in build 1.1.29 on October 13. The fix status of Claude Desktop was unclear at publication.
Am I at risk if I use VS Code or Codex?
The risk depends on your configuration and habits. The file-reading flaws require opening a malicious local HTML file inside the tool, so developers who only work with trusted projects face less exposure. But anyone who previews files from unvetted projects, or follows links an assistant offers into unfamiliar local files, should treat the risk as real until a fix is confirmed.
Do I need to stop using these tools?
No. Update Cursor and Copilot, avoid opening untrusted HTML files in Codex and VS Code for now, review agent commands before approving them, and keep credentials out of project folders. Those steps cover the demonstrated attacks without giving up the tools.
Why did Anthropic and Microsoft decline the reports?
Both vendors pointed to Workspace Trust, the prompt that asks developers to confirm they trust a folder. Their position is that trusting a folder is the security boundary. The researchers argue that trusting a project is not consent to let any file inside it read SSH keys and tokens from elsewhere on the machine.