Embedded browsers in five AI coding tools found to leak files

Security startup Forever Security disclosed on 29 October 2026 that it had found vulnerabilities in the embedded browsers of five AI developer tools: Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex. According to a report by Forever researcher Gal Weizman, published the same day, the flaws could allow attackers to run code on a developer's machine, read and steal local files, or spoof the address bar shown to the user. Forever says the Codex and VS Code issues are still unfixed.

The firm groups the bugs under the name "Embrace", short for embedded browser. The common thread, Weizman wrote, is that each tool "enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab's own address, or as reach onto the host".

In Cursor, the integrated browser lets a web page call the agent's composer. The agent treats the content as instructions and acts on it, while the text stays hidden from the human user. Forever says this opens the door to prompt injection — where attacker-controlled content is read as commands — and therefore to command execution on the host. Forever disclosed the bug to Cursor on 10 September and says the company silently patched it on 1 October without publishing an advisory or replying to the researchers. Cursor did not respond to The Register's request for comment.

The GitHub Copilot issue was address bar spoofing. Copilot's browser preview let the page tell the app its own address, and the app checked only that the text looked like a URL beginning with http, https or file, according to Forever. That could be used to display a convincing address such as github.com/login while a different page, such as a phishing site, loaded underneath. Forever found the flaw in version 1.1.27 on 26 September. GitHub fixed it in build 1.1.29 on 13 October without having received a report from Forever. GitHub did not respond to The Register.

Claude Desktop, VS Code and Codex shared an arbitrary file read problem. Local HTML files opened in the built-in browser could reach files outside their boundaries. Claude Desktop and VS Code restricted local pages to their project folders, but Forever found the restriction did not apply to web workers, background JavaScript threads that could reach any file on the machine. Codex had no such restriction at all, the researchers said.

Forever says it reported the Claude Desktop bug to Anthropic on 23 July and was told it was invalid because of a "workspace trust" security boundary; Weizman says Noma Security reported the same flaw a day later and Anthropic accepted it. Forever reported the Codex bug to OpenAI on 27 July and received no response, and the VS Code bug to Microsoft on 10 September, which it says was also labelled invalid. Anthropic, OpenAI and Microsoft did not respond to The Register's questions.