EMBRACE: What the Embedded-Browser Flaws in AI Coding Assistants Teach Us

On October 29, 2026, Forever Security published research by Gal Weizman on the browsers that five desktop AI assistants now ship and drive: Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. The team broke a core browser-security rule in every one. The Register covered the findings the same day.

The five products do not share one bug. They share one pattern, which the researchers named EMBRACE (EMbedded BRowser): each vendor enriched its embedded browser beyond what a normal browser allows, and each enrichment became an entry point.

The researchers state that the Codex and VS Code issues were still open when they published. The research does not say whether a Claude Desktop fix has shipped. An OpenAI spokesperson told The Register the company is aware of the Codex issue and working to address it.

A normal browser treats every page as hostile. The research identifies three rules that these products relaxed so their features would work:

• A local file:// page normally cannot reach other files. Here it could, so a preview can load its neighbouring files.
• A page normally cannot talk to the application around it. Here it could, so the agent can read the tab.
• A page normally cannot choose its own address. Here it reported one, so the agent knows where the tab is.

As the researchers put it, each change is reasonable on its own, and each one hands a hostile page what the browser used to deny.

The file-origin point is worth dwelling on. MDN's documentation on the same-origin policy notes that modern browsers usually give file:/// documents opaque origins, so even files in the same folder are not treated as same-origin. The URL specification leaves file origins implementation-dependent, and MDN flags that treating sibling files as same-origin has security implications. Claude Desktop, Codex and VS Code chose the permissive interpretation so previews could load sibling assets, then tried to fence reads back inside the project.

The lesson for anyone building tools is architectural, not a single patch: once an embedded browser is wired to an agent and the host, it is no longer just a viewer. It is part of the agent's trusted computing base, and every capability added to it needs its own threat model.

The three variants exploit different enrichments, but each one turns content the attacker controls into something the user or the agent trusts.

Anthropic and Microsoft declined Forever's file-read reports as invalid, citing Workspace Trust as the security boundary (Anthropic later accepted Noma Security's report of the same issue). That disagreement matters more than any single bug.

VS Code's documentation describes Workspace Trust as letting you decide whether code in a project folder can be executed. Unfamiliar folders open in Restricted Mode, which disables agents in that workspace and blocks or gates the terminal, tasks, debugging and some workspace settings. The same documentation calls it an extra layer of security, says it cannot stop a malicious extension from ignoring Restricted Mode, and advises: when in doubt, leave a folder in Restricted Mode.

So the vendor position is coherent: if you trusted the folder, you accepted that its contents may run. The research scenario shows where that model strains. People routinely trust folders so the agent can work in them, and in the demonstrated delivery path the click came from a link the assistant itself rendered. The read then reached files far outside the folder that was trusted.

There is no settled answer yet, but there is a practical takeaway: treat Workspace Trust as a decision about whether a folder's contents may act on your whole machine, not just on the project. That is the position Microsoft took in declining the VS Code report.

• Update. Make sure Copilot is on 1.1.29 or later and Cursor is current; both fixes shipped in October.
• Treat Codex and VS Code previews of untrusted projects as exposed. The researchers report both issues as open at publication. Do not open file:// previews from projects you did not create, including links an assistant renders for you.
• Leave unknown folders in Restricted Mode. Workspace Trust in VS Code disables agents in untrusted workspaces. Use that default for downloaded archives, demo repos and anything shared with you.
• Do not run auto-run with an empty allowlist. In the Cursor chain, auto-run turned a hidden injection into a one-keystroke execution. Require confirmation for commands, and read what you confirm.
• Shrink what a file read can steal. The demonstrated sweep collected SSH keys, .env files and npm tokens. Keep long-lived secrets out of plaintext files in your home directory where you can, and prefer short-lived, scoped tokens on machines that run agents.

The fixes follow from the research's root-cause analysis and line up with established guidance. OWASP's LLM01 entry on prompt injection describes indirect injection as instructions arriving through external content such as web pages or files, notes that no fool-proof prevention is known, and recommends least privilege, human-in-the-loop controls for privileged operations, and clearly separating untrusted content.

The broader rule: every capability you add to an embedded browser widens the boundary between untrusted content and the host. Write down the threat model for each one before you ship it, because the browser's own model no longer covers you.