EMBRACE Attack: AI Coding Tools' Built-In Browsers Can Read Your Entire Disk

What Is EMBRACE and Why It Matters

If you use an AI coding assistant — and in late 2026, most developers do — the browser embedded inside it is now part of your attack surface. On October 29, security firm Forever Security published research it calls EMBRACE (an EMbedded BRowser trusted like a real one): a class of flaws it found in all five of the desktop AI assistants it tested — Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Claude Desktop.

The five products don't share a single bug. They share something worse: a pattern. Each one embedded a browser inside its app and then enriched it beyond what a normal browser allows — letting pages talk to the agent, letting pages report their own address, letting local files reach their neighbours. Every one of those enrichments is reasonable on its own. Together, they dismantled the browser security model that has protected users for two decades. The achievable impact ranged from running code on the host (Cursor) to reading and exfiltrating every file on the disk (Codex, Claude Desktop, VS Code) to spoofing a tab's address to both the human and the agent (Copilot).

The kicker: at publication, the Codex and VS Code flaws were still unpatched. Anyone using either tool is exposed.

Cursor: A Web Page Could Run Code on Your Machine

Cursor's integrated browser adds a JavaScript bridge so the agent can observe the page you're viewing. Forever Security found that any page — any origin, no user gesture — could call that bridge and inject text directly into the agent's composer: the instruction box the AI reads as if you typed it. The injection renders as an invisible chip; you see almost nothing while the agent reads every field.

The clever part is how the payload beats the agent's own skepticism. A command in a single attribute gets refused, so the attack splits it across multiple attributes and asks the agent to reassemble and run it. When the resulting npm install hit Cursor's sandbox and was blocked, the agent itself cancelled, disabled the restriction, and retried — handing the malicious package's preinstall script full privileges. From a cold start in an empty workspace, the proof of concept popped Calculator on the host. Success is probabilistic and model-dependent, but the finding stands: a visited web page reached host code execution at all. Cursor silently patched the flaw on October 1, three weeks after disclosure, with no advisory.

GitHub Copilot: The Address Bar That Lies

Copilot's browser preview had a subtler problem. Some pages change their address without a full navigation, and the app can't always detect it — so Copilot let the page tell the app its own address, and showed that claim both to you and to the agent. The only validation was that the string looked like a URL.

The result: a phishing page parked on an attacker's server could display https://github.com/login in the address bar — the one place people check — while never actually navigating there. The agent was told the same lie, so an assistant asked to "log into GitHub" would confidently interact with the fake page. GitHub independently fixed this in Copilot 1.1.29 on October 13, before Forever Security even sent its report; version 1.1.27 was vulnerable.

Codex, Claude Desktop and VS Code: Whole-Disk File Theft

The most impactful variant targets local files. A normal browser gives a file:// page an opaque origin so it can't read other files; these assistants relax that so previews can load their siblings. The project-folder fence is real — but it only runs in the top document. Inside a web worker, the restrictions simply aren't applied, and any out-of-scope file:// fetch returns the file's contents in full.

From there, the researchers turned "read a file by path" into "walk the entire filesystem" with no directory API at all: macOS .DS_Store files index every folder a user has opened in Finder, and a small parser turns each one into a directory listing to recurse outward from the home directory. On the research machine, the sweep pulled SSH keys, .env files, npm tokens and private documents — no file type protected. On Codex, no worker was even needed: the file-read fence didn't exist, and a plain fetch from the page returned any file on the machine.

The delivery is what makes it dangerous in practice. The malicious project masquerades as a dull financial-report page, and the single required click arrives wearing the agent's own trust: when you ask the assistant to "set up the project per the README," the assistant itself renders the clickable file:// link and hands it to you.

The Disclosure Timelines Nobody Wanted to Talk About

The timelines are their own story. Cursor never replied and shipped a silent fix with no security advisory, so users had no way to know they needed to update. Microsoft declined the VS Code report as invalid, deferring to its Workspace Trust boundary — even though its own documentation says Restricted Mode only tries to prevent automatic code execution. OpenAI has simply not responded since July. Anthropic initially declined the Claude Desktop report on the same Workspace Trust grounds, then accepted the identical flaw a day later when a second firm reported it.

How to Protect Your Setup Right Now

• Update Cursor and GitHub Copilot immediately — the patches exist and are silent, so you may already be protected, but verify your versions.
• Treat Codex and VS Code embedded-browser previews as unpatched. If you use either, avoid opening untrusted local HTML files or file:// links inside the app until a fix ships.
• Move credentials out of the workspace — SSH keys, .env files and npm tokens in or near project folders are exactly what these attacks harvest. Use secret managers and keep keys outside the home-directory tree the sweep walks.
• Inventory which assistants run on your endpoints — Forever Security's core advice. Every embedded browser is now an attack surface, and most security teams don't know which developers run which agents.
• Don't rely on the click as a safeguard. In every demonstration, the required user click came from a prompt the trusted assistant itself generated. Human-in-the-loop only works when the human sees what the loop actually contains.
• Consider browser-separated alternatives — terminal-first agents like Claude Code, or editors that keep previews in a real hardened browser such as Windsurf or Zed, avoid the embedded-browser trust problem by construction.

Frequently Asked Questions