EMBRACE: Vulnerable Browsers in Five AI Tools

Researchers at Forever Security (Gal Weizman) described the EMBRACE class of vulnerabilities in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop, where web pages gained privileges not available in standard browsers.

Compiled by Sergey KostenchukPublished 2026-10-31Updated 2026-10-31

2026-10-31 Coding OpenAI

💻 EMBRACE: Vulnerable Browsers in Five AI Tools

Researchers at Forever Security described the EMBRACE class of vulnerabilities in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop. In Cursor, a page could inject a command into the agent and execute code on the host (fixed on October 1); in Copilot, it could spoof the address bar (fixed on October 13).

🌍 Embedded browsers in AI tools have gained privileges not found in standard browsers: access to the agent, host files, and the address bar.

👤 In Codex and VS Code, local pages can steal SSH keys, .env files, and npm tokens—this remains unpatched to this day. Do not open untrusted HTML in the embedded browser.

Source 1: https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical Source 2: https://www.theregister.com/security/2026-10-29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508

Sources