Security
EMBRACE: flaws in the embedded browsers of Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex
Forever Security reports flaws in the embedded browsers of five AI tools. Cursor and Copilot are fixed; VS Code and Codex were not at publication.
As of October 30, 2026, the security firm Forever Security reports flaws in the embedded browsers of five AI coding tools: Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex. According to Forever, Cursor and Copilot have been fixed, while VS Code and Codex were not fixed at publication. For Claude Desktop, the status of Forever's variant is not stated, and a neighbouring flaw was fixed according to Noma Labs. This article rests on the researcher's account, which we have not verified independently, and most vendors have not commented.
The essentials
- Three classes of flaws: code execution through a bridge between a web page and the agent, a spoofed address bar, and reading of local files outside the project folder.
- Statuses differ: Cursor and GitHub Copilot are fixed according to Forever; VS Code and Codex were not fixed at publication; Claude Desktop is not stated for Forever's variant.
- What a vendor confirmed: only OpenAI, which told The Register it is "aware of the issue and working to address it". Everything else comes from Forever.
- What to do: update, avoid untrusted pages and unknown projects in embedded browsers, limit secrets on the machine.
We describe classes of flaws and statuses, never how to reproduce anything. We separate what is confirmed by a vendor, what is claimed by the researcher and what is not stated. Fixes may change after this date.
What does the EMBRACE research reveal?
Forever Security, an AI security company, published its research on October 29, 2026. Researcher Gal Weizman named it EMBRACE, for "EMbedded BRowser, trusted like a real one". The central idea: desktop AI tools embed a browser with capabilities an ordinary browser lacks (a bridge to the agent, local file access, its own address bar), which breaks the usual threat model of the web. No CVE identifier is mentioned in the sources we read.
Three classes of flaws, per Forever:
- Code execution through a page-to-agent bridge (Cursor).
- Address bar spoofing (GitHub Copilot).
- Reading local files outside the project folder through a local HTML page (Codex, VS Code and Claude Desktop). According to Forever, on its test machine this could lead to the theft of SSH keys, developer tokens, environment files and private documents.
The chart below sums up each tool's status as reported by Forever.
Source: Forever Security, Help Net Security, The Register, Hackread, verified 2026-10-30. Statuses are those reported by Forever, not vendor confirmations.
Which tools are affected and where do the fixes stand?
Everything below is "according to Forever" unless stated.
- Cursor: a page loaded in the embedded browser could reach the agent's compose box and insert hidden instructions. In testing this ran a command on the host. Help Net Security notes the attack depends on the model and does not work on every attempt. Reported September 10; Cursor did not reply to Forever. Forever observed that the flaw was quietly fixed on October 1, with no security advisory and no version number.
- GitHub Copilot: a page could make the preview display a false address, for example a fake sign-in page, while another page was loaded. Tested version 1.1.27, found September 26; GitHub fixed it in version 1.1.29 on October 13, before any report from Forever.
- Claude Desktop (Anthropic): the same class of local file reading. Forever says it reported it on July 23 and that Anthropic rejected it under its "Workspace Trust" security boundary. Forever adds that another company, Noma Security, reported "the same flaw" on July 24 and that Anthropic accepted it as valid. Forever's post does not state explicitly whether its own variant is fixed.
- Codex (OpenAI): the embedded browser lacked the restriction to the project folder, so a local page could read files directly. Reported July 27; no reply received by Forever; not fixed at publication.
- VS Code (Microsoft): the restriction to the project folder covers the page but not its background scripts (web workers). Reported September 10; according to Forever, Microsoft classed the report as invalid under "Workspace Trust"; not fixed at publication.
Separately, Noma Labs published "SneakPeek" on October 14, 2026, a neighbouring flaw in the HTML preview pane of the Claude Code desktop app. According to Noma, relayed by CSO Online, a first fix was bypassed and the final fix ships in Claude Desktop 1.30096.1 and later (August 17, 2026), with a CVSS 8.7 score (high, v4.0) given by Anthropic and a CVE in preparation. Forever treats it as the same flaw as its own; the sources we read do not confirm that the fix covers Forever's variant, so we draw no conclusion for it.
What do vendors confirm and what do they not?
On the sources we read, one vendor position is confirmed: a spokesperson for OpenAI told The Register that the company is "aware of the issue and working to address it". Cursor, GitHub, Microsoft and Anthropic had not replied to The Register when it published.
Everything else is the researcher's account: report dates, the absence of replies, the "not fixed" status, and the reports said to have been rejected under Workspace Trust. These are reported positions, not findings about the vendors. Noma's report date also differs between accounts: July 24 according to Forever, July 4 according to Noma as relayed by the press. We do not decide between them.
Why is an embedded browser riskier than a normal browser?
A normal browser treats a web page as untrusted: it runs in a closed space with no access to the rest of the machine. An embedded browser in an AI tool sits next to an agent that can act on the machine, can reach local files and shows its own address bar. If the boundary between the page and those capabilities is weak, a page gets more reach than it should. In general terms, a restriction to the project folder can apply to the page and still not to everything the page can start.
Forever's wider point concerns Workspace Trust, the prompt asking whether to trust a project. The researcher says it protects almost nothing in practice, because developers click "trust" to be able to work. That is Forever's assessment, not a vendor statement. For wider context, see our article on AI-generated code security.
How long do reports stay open?
The chart shows the number of days between the report and the fix, or between the report and October 29 when the flaw was still open. These durations are calculated from the dates reported by Forever, not published by the vendors.
Source: calculated from dates reported by Forever Security, verified 2026-10-30.
Cursor took 21 days from report to fix; Copilot 17 days from discovery to fix (no report). VS Code was at 49 days and Codex at 94 days, both still open on October 29; Claude Desktop at 98 days since Forever's report, status not stated. We do not know the reasons behind these durations.
How many developers are concerned?
These figures are estimates from Forever, cited by Hackread. About 40 million developers use VS Code, and Codex has more than 5 million weekly users. Forever speaks of "hundreds of millions" of potentially concerned users. These are installed-base estimates, not counts of affected machines.
What should you do now?
- Update. GitHub Copilot 1.1.29 or later. Cursor up to date (fixed October 1, version not published). Claude Desktop 1.30096.1 or later, the SneakPeek fix version according to Noma; check the version after restarting.
- VS Code and Codex (not fixed at publication). Do not open untrusted HTML pages or unknown projects in the embedded browser. Do not mark a project as trusted out of habit, and review your list of trusted projects (Forever's advice, relayed by Help Net Security).
- Reduce what is exposed. Prefer narrowly scoped, short-lived tokens and avoid long-lived keys and secrets on the development machine. This is general hygiene, not specific to EMBRACE.
- Organizations. Identify these tools on workstations and review the controls around their embedded browsers (Forever's advice, via Hackread).
Tool pages: Cursor, GitHub Copilot, Claude Code, Codex.
Comparison table
| Tool | Class of flaw | Report | Vendor response | Status on Oct. 29 |
|---|---|---|---|---|
| Cursor | Page-to-agent bridge | Sept. 10 (Forever) | No reply to Forever; none to The Register | Fixed Oct. 1, no advisory (Forever) |
| GitHub Copilot | Address bar spoofing | Found Sept. 26; no report | Fix in 1.1.29, Oct. 13 | Fixed (Forever) |
| Claude Desktop | Local file reading | July 23 (Forever) | Rejected under Workspace Trust, per Forever; Noma's report accepted, per Forever | Not stated for Forever's variant |
| Codex | Local file reading | July 27 (Forever) | No reply to Forever; OpenAI "aware of the issue" (confirmed) | Not fixed (Forever) |
| VS Code | Local file reading | Sept. 10 (Forever) | Invalid under Workspace Trust, per Forever | Not fixed (Forever) |
Frequently asked questions
Which tools are affected?
Forever Security reports flaws in the embedded browsers of Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex, in three classes and with different statuses.
Are the flaws fixed?
According to Forever, Cursor (October 1) and GitHub Copilot (October 13) are fixed, and VS Code and Codex were not fixed at publication. For Claude Desktop the status of Forever's variant is not stated, and the fix for a neighbouring flaw is in 1.30096.1 according to Noma.
Is Claude Code on the command line affected?
Forever did not report testing it: the research covers the embedded browsers of desktop applications. That does not mean the command-line tool is safe; it was not examined in the sources we read.
What should I do if I use VS Code or Codex?
Avoid untrusted HTML pages and unknown projects in the embedded browser, do not mark projects as trusted out of habit, keep long-lived secrets off the machine where you can and watch for vendor updates.
Method and limits
This article relies on Forever Security's account of October 29, 2026, as relayed by Help Net Security, The Register, Hackread and CSO Online, not verified independently. Dates, replies and statuses are the researcher's claims, except OpenAI's statement to The Register. The vendors approached by The Register (Cursor, GitHub, Microsoft, Anthropic) had not replied when it published. We did not re-read the Noma Labs page directly. Durations are our calculations. This is not security advice for a specific environment, and fixes may have changed since.
Sources
- Forever Security: EMBRACE, hacking 5 AI assistants' embedded browsers (technical) (verified 2026-10-30)
- Help Net Security: research on AI assistant browser vulnerabilities (verified 2026-10-30)
- The Register: researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (verified 2026-10-30)
- Hackread: EMBRACE flaws in AI coding tools (verified 2026-10-30)
- CSO Online: Claude Code's 256KB blind spot (SneakPeek, Noma) (verified 2026-10-30)
- Noma Labs: SneakPeek (cited by the press, not re-read directly)
Spotted an error in this article? Report it · Our corrections policy
