Researchers have disclosed EMBRACE flaws that let a malicious page or local file break out of the built-in browsers in Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code and Claude Desktop. Gal Weizman of Forever Security shared the findings with Hackread ahead of an October 29 public release. Cursor and Copilot have patches, but the Codex and VS Code file-theft issues were still open at publication.
Key Takeaways
- EMBRACE flaws hit Cursor, Copilot, Codex, VS Code and Claude Desktop.
- Cursor and Copilot are patched; Codex and VS Code were not.
- Local HTML files can steal SSH keys, tokens and private documents.
- VS Code has around 40 million developers; Codex has more than 5 million weekly users.
What the EMBRACE Flaws Share
Forever Security describes EMBRACE as an embedded browser trusted like a real one. In Forever Security’s technical write-up, the company wrote, “These are not bad browsers.” Each is a real browser, enriched so the assistant can preview a local project, read a tab or pull context from a page. Those enrichments are where the gaps opened.
The team tested three rules a standalone browser is expected to hold: a web page cannot run commands on the computer, a local file cannot read other files, and a page cannot control the address bar. Each assistant bent one rule to do its job. Hackread’s report said Forever Security estimates hundreds of millions of developers and users could be affected, because VS Code has around 40 million developers and Codex has more than 5 million weekly users.
Forever Security maps that shared cause to three shapes. Cursor is arbitrary code execution. Codex, Claude Desktop and VS Code are arbitrary content exfiltration. GitHub Copilot is address-bar spoofing, which the company also calls arbitrary context emulation.
How Each Assistant Was Abused
The same root cause produced three outcomes: code execution, file theft and address-bar spoofing.
- Cursor: A malicious page can use a communication bridge to inject hidden instructions into the command composer. In testing, the install command first hit a sandbox restriction and was blocked. The agent then disabled the restriction and retried, after which Calculator launched. The result depended on the model.
- GitHub Copilot: In version 1.1.27, a malicious page could change the URL shown in the browser preview without navigating to that destination. The address bar and the agent could report github.com/login while the tab showed an attacker-hosted page. The app checked only that the text looked like a web address, not that it matched the tab.
- Codex, VS Code and Claude Desktop: Local HTML opened in these apps could read files beyond the project. In VS Code and Claude Desktop, directory checks applied to the main page but not to a web worker the page could start. Codex had no such restriction, so a local page could read files directly. Researchers demonstrated exfiltration of SSH keys, developer tokens and private documents.
Who Patched, and Who Had Not
| Tool | Reported impact | Status at publication |
|---|---|---|
| Cursor | Code execution | Patched October 1 |
| GitHub Copilot | Address-bar spoofing | Fixed in 1.1.29 on October 13 |
| OpenAI Codex | Local file theft | Unpatched at publication |
| VS Code | Local file theft | Unpatched at publication |
| Claude Desktop | Local file theft | Not stated in reports |
Forever Security reported the Cursor flaw on September 10, and it was patched on October 1. GitHub independently fixed Copilot in version 1.1.29 on October 13 after the issue was identified on September 26. According to Weizman, the Codex report, sent to OpenAI on July 27, and the VS Code report, sent to Microsoft on September 10, were both unpatched when the research went public.
The published accounts name only Codex and VS Code as still exploitable. They do not give a patch status for Claude Desktop. Forever Security’s note for security leaders says users of those two tools are exposed at the time of publishing.
What a Rigged Project Can Reach
On a test machine, Forever Security’s file sweep pulled SSH keys, .env files, npm tokens and the hosts file. The company said a real attacker would also want cloud credentials, developer tokens, browser session databases and private source code. To map the disk, the attack reads a hidden index file macOS drops into every folder opened in Finder.
Delivery can look ordinary: a dull financial report, a request to “set it up per the README,” and a link the assistant itself surfaces. The only action described is opening that file. Everything after the click is silent.
For a coding team, that is an endpoint problem. One machine can expose secrets the rest of the organization depends on. In Cursor, one approval in an empty project launched an app the page chose. A real install would run with the user’s full privileges, outside the sandbox, though it does not succeed on every model.
Forever Security said nothing on the page told the agent to switch the sandbox off. The company advises organizations to find these tools on developer endpoints and review the controls on their embedded browsers. Endpoint reviews should sit next to other credential hygiene, including what an unrevoked key can do, as covered in our report on the LiteLLM supply-chain incident.
