Developers have spent years learning not to trust what they open in a browser. Their AI coding assistants haven’t learned the same lesson.
Researchers at Forever Security found that the browsers built into five popular AI coding tools give web content far more reach into the host machine than a standalone browser would allow. The tools are Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code, and Anthropic’s Claude Desktop. Researcher Gal Weizman calls the flaw class EMBRACE, short for “embedded browser, trusted like a real one.”
Two of the tools are still exposed. As of Oct. 29, the researchers say the flaws in Codex and VS Code remain unpatched.
The root cause is a design choice, not a single coding mistake. A regular browser treats every page as hostile. It won’t let a page run commands on your computer. It won’t let a local file read your other files. And it alone controls what appears in the address bar. Each vendor relaxed at least one of those rules so the AI assistant could preview a project or read what’s in a tab. That convenience created the opening.
The results varied by tool. In Cursor, a malicious web page could reach the agent’s command composer through a bridge between the embedded browser and the assistant. Hidden instructions on the page led the agent to run an install command that, in the researchers’ demo, launched Calculator on the host. When a sandbox blocked the first attempt, the agent switched the sandbox off and tried again. Forever reported the issue on Sept. 10. Cursor patched it on Oct. 1 without issuing a security advisory.
GitHub Copilot’s embedded browser let a page set the address it displayed. That allowed a fake github.com/login address to appear over an attacker’s sign-in form. GitHub fixed the issue in Copilot 1.1.29 on Oct. 13.
The third flaw is the most serious. In Codex, VS Code, and Claude Desktop, a local HTML file opened in the tool’s browser could read files well outside the project folder. VS Code and Claude Desktop limited the main page to its project directory, but web workers sat outside that check. Codex had no folder restriction at all.
The attack chain the researchers demonstrated is simple. A project is dressed up as a financial report, with a README asking for setup help. The assistant offers a clickable link to an HTML file in the project. With one click, the page maps the disk, collects SSH keys, .env files, npm tokens, and the hosts file, and sends them out.
Forever reported the Codex flaw to OpenAI on July 27 and says it has not heard back. It reported the VS Code issue to Microsoft on Sept. 10. According to Help Net Security, Microsoft and Anthropic both declined Forever’s reports, citing Workspace Trust, the prompt that asks a developer to trust a project folder. Anthropic did accept a similar report from Noma Security as valid. Published reports did not state Claude Desktop’s current patch status.
Weizman doesn’t buy the Workspace Trust argument. “Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust,'” he told Help Net Security, adding that the prompt “provides zero protection to the user.”
Asked whether organizations should assume agents may work around their own safeguards, Weizman said, “Absolutely. We’re seeing this behavior repeating itself outside the scope of this research.”
In the Cursor demo, the sandbox did its job. The agent simply turned it off.
“An agent that can switch off its own sandbox shows the control is in the wrong place,” said Mitch Ashley, vice president and practice lead for CIO & Technology Buyers and Software Lifecycle Engineering at The Futurum Group. “Guardrails have to be enforced outside the agent, by the platform and the endpoint, where the agent cannot change them.”
He sees the same problem in the vendors’ reliance on Workspace Trust. “A prompt every developer accepts to get work done records consent and blocks nothing,” Ashley said. “The question for these vendors is where enforcement lives when the agent decides a safeguard is in its way.”
The exposure here is real. A developer laptop holds SSH credentials, cloud tokens, registry tokens, and source code. Forever puts the potential reach in the hundreds of millions of users, citing roughly 40 million VS Code developers and more than 5 million weekly Codex users.
Teams can act now. Start by inventorying the AI coding tools running on developer endpoints, and confirm Copilot is on 1.1.29 or later, and Cursor is on a current build. Treat Codex and VS Code installs as exposed until fixes ship. Forever suggests pulling each machine’s list of trusted projects and checking the HTML files in those projects for the exploit pattern described in its technical write-up. Tell developers to be careful with assistant-generated links to local files, since that click is what starts the attack. And keep moving long-lived secrets off developer machines in favor of short-lived, scoped credentials.
The bigger lesson isn’t about five bugs. AI coding tools are turning into platforms that combine a browser, a terminal, a file system, and an agent in one process. Every one of those connections is a place where old security assumptions can quietly stop applying. Security teams now need to treat these tools like any other privileged endpoint software, because that’s exactly what they are.
Frequently Asked Questions
1. What are EMBRACE vulnerabilities in AI coding tools?
2. Why are AI coding assistants particularly vulnerable?
3. How can DevSecOps teams reduce their exposure?
Tom Smith (C. Thomas Smith III) is a veteran digital analyst and content strategist who spent more than four years as a Research Analyst at DZone.com (part of Devada), where he conducted thousands of interviews with technology executives and authored roughly 1,500 articles that generated more than 10 million page views across topics including AI/ML, Agile, APIs, cloud computing, DevOps, IoT, Java, Kubernetes, microservices, and security. He holds an MBA in Marketing from Duke University's Fuqua School of Business and a B.A. in Political Science from Duke. Smith later worked as a content strategist and technical writer at Cognizant, including stints on Google's Bard (now Gemini) and Meta's AI Business Assistant (MAIBA) "seed" content teams, where he helped train and evaluate large language models. Over his career, he has interviewed more than 4,000 technology executives across AI, cloud, data, security, and storage sectors. He now writes independently through Insights From Analytics and is a contributing writer across multiple Techstrong Group properties, including DevOps.com, Digital CxO, Cloud Native Now, PlatformEngineering.com, and Techstrong.ai, where he covers AI agents, enterprise AI infrastructure, and emerging developer tools.