EMBRACE: embedded browsers in five AI assistants leak files and run code

01What happened

Forever Security published EMBRACE on October 29, 2026, naming a class of flaws in the browsers that Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code and Claude Desktop embed and control. Gal Weizman and the Forever Security research team report that each vendor loosened a browser security rule to make its assistant work. Reports went to the five vendors between July 23 and September 10, 2026, and the dates and responses are listed below.

02How it works

Three variants make up EMBRACE, which Forever Security reads as EMbedded BRowser. In Cursor, a page-accessible messaging call inserted forged chip content into the agent's input, splitting a command across attributes to get past filtering, and the proof of concept launched Calculator. In Claude Desktop, Codex and Visual Studio Code, the limit on reading files outside the project folder applied only to the top document, so a web worker read across the disk, and in Codex the page needed no worker at all. In GitHub Copilot, the app displayed any address a page claimed, so a page could show github.com/login while serving other content.

03Who is affected

Codex and Visual Studio Code are the exposed products: Forever Security states that both issues are unpatched at publication and that anyone using either tool is still exposed. GitHub Copilot 1.1.27 carried the address flaw and GitHub fixed it in 1.1.29 on October 13, 2026. Cursor shipped a silent patch on October 1, 2026, and Microsoft declined the Visual Studio Code report as a Workspace Trust boundary issue.

04What to do

Update Cursor and move GitHub Copilot to 1.1.29 or later. For Codex and Visual Studio Code, Forever Security advises taking an inventory of which assistants run on your endpoints, treating each embedded browser as an attack surface, and not relying on a user click as a safeguard, because the clicks in the demonstrations came from trusted tool prompts.

Questions people ask

Is Visual Studio Code patched against the EMBRACE file read?

Visual Studio Code has no fix for the EMBRACE file read. Microsoft declined Forever Security's September 10, 2026 report, treating the behaviour as a Workspace Trust boundary issue, and the flaw was still unpatched when Forever Security published on October 29, 2026. Microsoft's own documentation says Restricted Mode tries to prevent automatic code execution, rather than guaranteeing that it cannot happen.

Which version of GitHub Copilot fixes the address spoofing?

GitHub Copilot 1.1.29, released on October 13, 2026, fixes the address spoofing that Forever Security found in version 1.1.27. GitHub shipped the fix on its own, before Forever Security filed a report. In the vulnerable build the app displayed whatever address a page claimed, so a page could present github.com/login to the user and to the agent while serving different content.

How does an attacker reach a developer's files through EMBRACE?

An attacker publishes a project that looks ordinary, for example a page that presents itself as a financial report. Forever Security describes the assistant itself offering a clickable file:// link, and once the page loads inside the embedded browser a web worker reads files outside the project folder. The researchers mapped directories using macOS .DS_Store files and sent data to a local sink in their proof of concept.

Did Anthropic fix the Claude Desktop file read?

Anthropic declined Forever Security's Claude Desktop report on July 23, 2026 and accepted an equivalent report from Noma Security the next day, according to Forever Security, which names only Codex and Visual Studio Code as unpatched. Forever Security's post does not state a Claude Desktop fix version, so Claude Desktop users should confirm their build with Anthropic.

How is EMBRACE different from the Downloads folder AGENTS.md attack?

EMBRACE abuses the browser each assistant embeds, while the Downloads folder attack Forever Security published on October 22, 2026 plants an AGENTS.md instruction file that a coding agent then reads. EMBRACE needs no agent instruction file: the page or local file acts through the browser's own loosened security rules to read the disk or reach the host.

Sources 3 links, all fetched

1. 1forever.securityTechnical Write-Up
2. 2forever.securityEMBRACE Overview
3. 3code.visualstudio.comVS Code Workspace Trust