Researchers at Forever Security (Gal Weizman) described the EMBRACE (EMbedded BRowser trusted like a real one) class of vulnerabilities: the embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop granted web pages privileges that web content in a standard browser does not have. The most dangerous chain occurred in Cursor — a page could inject a command into the agent composer and achieve code execution on the host. In Codex, VS Code, and Claude Desktop, a page could read files outside the project, including SSH keys, .env files, and npm tokens. Cursor and GitHub have already released fixes, while vulnerabilities in Codex and VS Code remained open as of October 29, 2026.

image
image
image

What happened

Researchers at Forever Security (Gal Weizman) published a technical overview of the EMBRACE class of vulnerabilities, affecting the embedded browsers of five products: Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop. In Cursor, a web page could use the window.cursorBrowser.send bridge to inject a command into the agent composer and achieve code execution on the host; the proof-of-concept launched the Calculator application via an npm package preinstall script. Cursor closed this vulnerability on October 1, 2026, without publishing a notification. In GitHub Copilot, a web page could spoof the address bar content and display, for example, github.com/login over a phishing form; GitHub released its own fix in version 1.1.29 on October 13, 2026. In OpenAI Codex, VS Code, and Claude Desktop, local file:// pages could read files on the user's machine outside the project: in VS Code and Claude Desktop, access was via Web Workers, while in Codex it was direct. This allowed stealing SSH keys, .env contents, and npm tokens. The publication The Register noted on October 29, 2026, that vulnerabilities in Codex and VS Code remained unfixed at that time.

Context

EMBRACE is the name of the class, highlighting a systemic trust error: vendors embedded full browser engines in agent tools and treated them like regular browsers, but granted them privileges that web content in the classic browser model should not have. The classic model assumes that a web page is untrusted content: it has no access to the user's file system, local applications, or trust indicators like the address bar. In agent environments, these boundaries were violated differently in each of the five products — sometimes through a channel to the agent composer, sometimes through trust indicators, sometimes through access to local files — but the essence is the same: a page in the embedded browser was not isolated from either the agent or the host. In other words, EMBRACE describes not a set of random bugs, but an architectural trust problem at the boundaries of 'page — browser — agent — host,' which vendors did not explicitly design for.

Why this matters for the industry

For the AI industry, this event marks a new privileged attack surface: embedded browsers in agent tools gained capabilities — access to the agent composer, host files, and the address bar — that web content in regular browsers does not have, breaking the classic browser threat model. Vendor reactions showed that the costs of such an architecture are unevenly distributed: Cursor and GitHub closed their vulnerabilities, while OpenAI and Microsoft had not closed theirs as of October 29, 2026. For teams building agent products, the EMBRACE class becomes a specific product task: designing isolation between web content and the agent, including separate bridge APIs, sandboxes for pages, and explicit source verification for commands, as well as checking existing integrations with agent bridges before researchers do. For security researchers, the work by Forever Security is a well-documented class with reproducible PoCs that can be applied to audit their own agent bridges and vendor webviews.

Why this matters for users

If you work in OpenAI Codex or VS Code, do not open untrusted, especially local file://, HTML pages in the embedded browser of these tools: such vulnerabilities were not fixed as of October 29, 2026, and a page could read files on your computer outside the project, including SSH keys, .env contents, and npm tokens. Additionally, it is advisable to move secrets from locations readable by the editor process, and if you suspect untrusted content was opened, re-check keys and tokens on that machine. For Cursor and GitHub Copilot users, critical issues have already been closed — the Cursor patch was released on October 1, 2026, and the Copilot fix in version 1.1.29 on October 13, 2026, so it is sufficient to keep the tools updated. A separate lesson for everyone: address bar spoofing in Copilot made phishing almost indistinguishable from the real github.com/login, so trust indicators within the tool itself should not be relied upon, even after the patch was released.

What is currently unknown / limitations

Available materials do not include CVE identifiers, severity ratings, or descriptions of independent third-party replication: conclusions are based on the primary source's technical overview and its coverage in The Register. The materials do not specify whether the vulnerability in Claude Desktop has been closed, nor do they disclose the full timeline of responsible disclosures. Predictions that embedded browser security will become a procurement criterion or a source of product advantage are not supported by observations of buyer or market behavior in the sources and remain interpretations.

Sources

Author

Look at AI, editorial team