EMBRACE is a name Forever Security gave to a class of flaws it reported on October 29, 2026, short for EMbedded BRowser trusted like a real one. The researchers say five AI coding assistants gave their built-in browsers abilities a normal browser does not have, and that this let a web page or local file reach the machine behind it.

Which AI coding assistants did the research cover?

Cursor, GitHub Copilot, OpenAI's Codex, VS Code and Claude Desktop. The researchers report code execution in Cursor, reading of local files in Codex, VS Code and Claude Desktop, and address-bar spoofing in GitHub Copilot.

Are the issues fixed?

Per Forever Security, Cursor patched silently on October 1 and GitHub fixed Copilot on October 13 before any report. The Codex and VS Code issues were unpatched when the post was published. Forever does not say whether its Claude Desktop finding is fixed; Noma Labs reports that Anthropic fixed a closely related preview-pane issue on August 17 in Claude Desktop 1.30096.1 and later, without establishing that it covers every variant Forever demonstrated. The Register reports that OpenAI says it is aware of the Codex issue and working to address it.

Does VS Code's Workspace Trust fix the reported issue?

Forever Security says Microsoft declined its VS Code report as invalid because of a Workspace Trust gated boundary and that the issue was unpatched at publication. Workspace Trust is a separate protection for unfamiliar projects, and the post does not say whether a trusted project changes the outcome. We draw no conclusion and have not tested it.

Could a website really run code on my computer through Cursor?

In the researchers' demonstration, a page reached Cursor's agent and a command ran on the host, launching Calculator. They say success is probabilistic and depends on the model, and that Cursor patched the issue on October 1. We have not tested it.

Should my team stop using these assistants?

That is not our claim. Our recommendations are to list which assistants and versions are in use, avoid opening untrusted pages or unfamiliar local HTML in an assistant's built-in browser, keep command approval tight, and re-check vendor release notes.

How can a business owner act on this?

Ask whoever builds or maintains your software which AI tools touch your code and systems, what those tools can read and run, and who approves it. It is a question to ask, not a verdict on any product.

Did Waveo test these tools or reproduce the findings?

No. This article is based on the researchers' published posts and on The Register's report, and every status and date is theirs. We will update the page if the vendors respond.

EMBRACE: Browser Flaws in 5 AI Coding Tools

A browser window frame inside a code editor panel with one red line crossing from the browser into the editor, a web page reaching the machine behind it

The short version

On October 29, 2026, Forever Security (researcher Gal Weizman) published research on the browsers built into five AI coding assistants: Cursor, GitHub Copilot, OpenAI's Codex, VS Code and Claude Desktop. It says each product gave its embedded browser abilities a normal browser lacks, and reports code execution on the host in Cursor, reading of local files outside the project in Codex, VS Code and Claude Desktop, and a spoofed address bar in Copilot. Per the researchers, Cursor patched silently on October 1 and GitHub fixed Copilot on October 13 before any report, while the Codex and VS Code issues were unpatched when the post was published. Noma Labs separately reports that Anthropic fixed a closely related Claude Desktop issue on August 17. This is the researchers' account, no CVEs are listed, and we have not tested or reproduced any of it.

The failure here is a pattern, not one bug. According to research published on October 29 by Forever Security (researcher Gal Weizman), Cursor, GitHub Copilot, OpenAI's Codex, VS Code and Claude Desktop each built a browser into their desktop apps and gave it abilities that an ordinary browser does not have, and those abilities opened a path from a web page or a local file to the machine behind it. This is a document-based read of the researchers' post, of Noma Labs' related post on Claude Desktop and of The Register's coverage. It is the researchers' account, the vendor statuses and dates below are theirs, and we have not tested or reproduced any of it.

What is EMBRACE?

Forever Security coined EMBRACE, short for "EMbedded BRowser trusted like a real one", for a class of flaws. Modern browsers generally treat every page as hostile: a page cannot run commands on the host, a local file is kept apart from unrelated files, and the address bar stays under the browser's control. According to the post, each assistant relaxed one of those rules so the agent could do its job, and each relaxation handed a hostile page something the browser used to deny. The researchers describe three variants.

Variant (researchers' name)	Product(s)	What the page or file could do, as reported
Arbitrary Code Execution	Cursor	A visited page could feed instructions to the agent, which led to code running on the host in the researchers' demonstration.
Arbitrary Content Exfiltration	Claude Desktop, Codex, VS Code	A local HTML page could read files outside its project folder, and in the proof of concept send them to another server.
Arbitrary Context Emulation	GitHub Copilot	A page could make the preview show a different address than the one it was really loaded from.

What did the researchers report in each tool?

Tool	Reported flaw	Status, per Forever Security (Oct 29)
Cursor	Its integrated browser lets any page call `window.cursorBrowser.send(...)`, which reaches the agent's composer with no user gesture. The researchers split a command across hidden attributes so the agent reassembled it. With auto-run on and an empty allowlist, one Enter keypress ran it. When Cursor's sandbox blocked `npm install`, the agent cancelled the run and retried, so the package's preinstall script ran with full privileges; the post says that step was not in the payload. The demo launched Calculator from a cold start. The researchers say success is probabilistic and depends on the model.	Disclosed September 10. The researchers say it was silently patched on October 1 and that Cursor never replied.
GitHub Copilot	The browser preview let a page tell the app its own address. The app checked only that the text looked like a web address, not where the tab really pointed, so a page on an attacker's host could show github.com/login in the address bar, to the person and to the agent.	Found September 26 on Copilot 1.1.27. GitHub fixed it independently in 1.1.29 on October 13, before the researchers sent a report. Those are the builds the researchers name for the preview they tested; check which Copilot client you run.
Claude Desktop	A page opened from a local file can read other files. The folder fence applies to the top document but not to a web worker, so a worker can read files across the disk.	Disclosed July 23 and declined as invalid because of a "Workspace Trust" gated boundary. Forever dates a report by Noma Security to July 24, accepted as valid. Forever's post does not say whether its finding is fixed. Separately, Noma Labs published on October 14 a closely related issue, "SneakPeek", in Claude Code Desktop's preview pane, which it says it reported on July 4 and which Anthropic fixed on August 17 in Claude Desktop 1.30096.1 and later, after a web-worker bypass of an earlier patch. The published accounts do not say whether that fix covers every variant Forever demonstrated.
VS Code	The same web-worker gap as Claude Desktop.	Disclosed September 10 and declined as invalid for the same "Workspace Trust" reason. Unpatched when the post was published, per the researchers. Workspace Trust is a separate VS Code protection for unfamiliar projects; the post does not say whether a trusted project changes the outcome, so we draw no conclusion.
Codex	No file-read fence on the page at all: a plain fetch of a local file path from the page returns the file.	Disclosed July 27 with no reply, per the researchers. Unpatched when the post was published.

No CVE identifiers are listed in the post. The Register reports that Cursor, GitHub, Anthropic and Microsoft did not respond to its requests for comment, and that an OpenAI spokesperson said OpenAI is aware of the Codex issue and working to address it. We have not obtained statements from the vendors ourselves.

How does the file-read attack start?

The researchers say the reads are silent but the victim has to open the file. In their delivery scenario, a project looks harmless and contains one ordinary-looking line that starts a web worker. When the user asks the assistant to set the project up from its README, the assistant itself shows a clickable local link, and one click opens the page. On their research machine, they say the sweep collected SSH keys, .env files, npm tokens, the hosts file and private documents; in the proof of concept everything went to a local test server. To find what to read, the worker used the .DS_Store index files that macOS leaves in folders, which list the files next to them. As far as the post shows, the reads covered files the app's own process could read; it does not claim to bypass operating-system permissions. All of this is the researchers' demonstration, not an incident in the wild.

What can a team do about it?

These are our recommendations, not the researchers' or the vendors'.

List what is in use. Find out which assistants with a built-in browser or preview pane your developers and contractors run, and on which versions. The Copilot address-spoofing fix is in 1.1.29, and the researchers say Cursor patched on October 1.
Treat page content as untrusted input to the agent. Do not open unknown web pages or unfamiliar local HTML files in an assistant's built-in browser, especially in a project you did not write.
Keep command approval tight. The Cursor demonstration relied on auto-run being on with an empty allowlist. Review auto-run and allowlist settings, and check whether the agent can retry a blocked command outside its sandbox without asking.
Limit what a file read could reach. For Codex and VS Code, which the researchers describe as unpatched, keep long-lived credentials such as SSH keys and tokens out of reach of the machine where you open untrusted projects, where you can.
Open unknown projects somewhere disposable. Use a separate machine or virtual machine without your working secrets to look at unfamiliar repositories and HTML, and keep production keys off machines that open untrusted content. This limits the damage; it does not fix the flaws.
Ask your contractors. Find out which AI tools they use, what credentials those tools can reach, and whether they may open unvetted projects in a built-in preview.
If exposure is possible, review credentials. If untrusted HTML was opened in an affected, unpatched assistant on a machine holding SSH keys, tokens or .env files, consider whether those secrets need to be rotated.
Watch for vendor responses. Re-check the vendors' release notes and the researchers' post. We will update this page if the vendors respond.

What does this mean if you run sales, logistics or retail?

You may never open Cursor or Copilot, but developers or contractors working for you might. The research reports that AI coding assistants can be tricked when they use a browser inside the editor. For an owner, the useful step is a question for whoever builds or maintains your software: which AI tools touch your code and systems, what can they read and run, and who approves it? That is a question to ask, not a verdict on any product.

How does this differ from the incidents we covered?

In Anthropic's S-1 incidents, models reached real systems after a test environment was left connected. In Cloudflare's GLM-5.3 leak, shared infrastructure returned one customer's data to another, and in the Cairn case an operator pointed AI agents at e-commerce sites. Here the weak point is a tool's own design: an embedded browser trusted like a real one. The causes differ. In our reading, the lesson they share is to verify a boundary from the outside instead of assuming it holds. For the broader picture of how agents fail in production, see why AI agents break in production, and for how these five tools compare on features, see our coding agents comparison.

What is still unknown?

The post lists no CVEs, and it does not say whether Forever's Claude Desktop finding has been fixed; Noma Labs reports a fix for a closely related issue, without confirming it covers Forever's variants. Most vendors have not been quoted. The Cursor result is described by the researchers as probabilistic, so it is not a guaranteed outcome. This is one research team's account, and we have not reproduced anything. GitHub also published a bundle of cloud-agent changes on October 28, which we cover separately in our GitHub teardown; it does not mention these findings. The same developments are in our October 30 digest.

EMBRACE: What Forever Security Reports About the Browsers in Five AI Coding Tools