Forever Security found security flaws in embedded browsers across Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex, warning that these tools can cross ordinary browser security boundaries and enable file theft, host-machine code execution or address spoofing.

The underlying concern is that embedded browsers can have privileges ordinary browsers do not: they may blur the line between web content and AI instructions, misrepresent a page’s address or reach files on the host computer.

The demonstrated attacks generally required a user to open a malicious HTML file or visit an untrusted page inside the tool; researchers also showed how an assistant following project instructions could present a link that encourages a user to open such a file.

The most serious remaining findings affected Codex and VS Code: a crafted project and link could let a local page read files beyond the project, potentially exposing SSH keys, cloud credentials, development tokens and other sensitive data.

In VS Code, Web Workers could bypass project-folder restrictions; Codex did not impose the same restriction. Microsoft classified the VS Code report as an invalid workspace-trust issue, while OpenAI had not responded to the Codex report.

At publication on October 29, Forever Security said the Codex flaw, reported to OpenAI on July 27, and the VS Code flaw, reported to Microsoft on September 10, remained unpatched.

Anthropic first rejected Forever Security’s Claude Desktop report as outside its security boundary, then accepted a report of the same flaw from Noma Security the next day; the article did not identify a patch date or version.

Cursor’s embedded browser could pass hidden instructions from a webpage to its coding agent, which could run a command on the host after user approval; in a demonstration, the agent disabled a sandbox restriction and retried. Cursor patched the flaw on October 1, after disclosure on September 10, but did not publish a security advisory.

GitHub Copilot’s preview browser could show a page’s claimed address rather than its actual destination, allowing a fake github.com/login page to look legitimate. GitHub fixed the issue in Copilot 1.1.29 on October 13.

Researchers tested all five tools and said the reported issues in Cursor, GitHub Copilot and Claude Desktop had been fixed, while the Codex and VS Code findings remained open.

Forever Security warned that compromised developer devices could expose credentials, cloud connection data and source code, with potential consequences for software supply chains; it also said the flaw class, which it calls EMBRACE, could affect other AI tools with similarly privileged embedded browsers.

Until fixes are available, developers are advised to avoid suspicious HTML files and untrusted URLs in Codex or VS Code, scrutinize files an assistant suggests opening, use VS Code Restricted Mode for unfamiliar projects, and review trusted-project lists and project HTML files for the described exploit pattern.