On 29 October 2026, AI security company Forever Security published research by Gal Weizman on a class of flaws it calls EMBRACE (EMbedded BRowser). The common problem: the browsers built into AI coding tools were given abilities a normal browser does not have, such as talking to the AI agent or reading local files, which breaks the usual browser security model. Five tools were affected. No CVE IDs have been published.
Cursor – code execution (fixed). A web page opened in Cursor's integrated browser could reach the agent's composer through an exposed bridge and inject hidden instructions (prompt injection). In the researchers' test, with auto-run on and the user pressing Enter once to approve a run card, the agent ran an install command that launched Calculator on the host; when the sandbox blocked it, the agent retried outside the sandbox. Success depended on the model's behaviour. Reported on 10 September, Cursor fixed it on 1 October without a security advisory.
VS Code, Codex and Claude Desktop – local file theft. If a user opens a malicious local HTML (file://) page in these apps, it could read files outside the project, including SSH keys, .env files and tokens, and send them out. In VS Code and Claude Desktop a web worker bypassed the project folder check; Codex had no such check. Microsoft (told on 10 September) treated it as outside its Workspace Trust boundary, and the researchers say VS Code is still unpatched. OpenAI (told on 27 July) told The Register it is aware and working on a fix; Codex is still unpatched. Anthropic first declined the report, then accepted the same flaw reported by Noma Security; whether Claude Desktop is fixed is not stated.
GitHub Copilot – address bar spoofing (fixed). In version 1.1.27, a page in the preview browser could make the address bar and the agent show github.com/login while an attacker's page was loaded, a ready-made phishing trick. GitHub fixed it on its own in version 1.1.29 on 13 October.
No exploitation in the wild has been reported. All attacks need the user to open an attacker's page or file inside the tool, for example a link in a README the agent was asked to set up.
