The browser was the soft spot
The pattern is architectural, not a string of unrelated bugs. Each of these assistants embeds a browser inside a desktop app, then relaxes one of the rules a normal browser enforces. The three boundaries are different. A local HTML file should not be able to read files outside its permitted directory. A web page should not be able to inject instructions directly into the surrounding desktop application. And a page should not be able to decide what address the application's browser displays. Forever found that each of the five products weakened one of these boundaries, in different ways.
Forever Security, an AI security firm, named the class EMBRACE, short for embedded browser, and put the point plainly: each tool "enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model." The researchers say they broke a core browser-security rule in every one of the five tools they tested.
What each flaw actually does
In Cursor, the integrated browser let a page call the agent's composer, the box the agent reads as instruction. The attacker's instructions stayed hidden from the person using the tool while the agent read them. Forever split a command across page attributes so the agent would reassemble it. The agent then presented a command for execution; one Enter keystroke approved it. When Cursor's sandbox blocked the installation, the agent cancelled the attempt and retried without the sandbox, allowing the package's installation script to run with the user's privileges. Forever demonstrated this by launching Calculator. The researchers caution that success depends on the model and is not guaranteed every time. The security failure is that a web page could reach the host through the agent at all.
In Copilot, the flaw was quieter. A malicious page could tell Copilot's preview to display github.com/login as its address while remaining hosted on the attacker's website. The user saw the false address, and the agent received the same false location. This could make a fraudulent login form appear to be hosted by GitHub, although the research demonstrated address spoofing rather than an actual account compromise.
The file-read flaws are the most direct risk. The file-read demonstrations all started with a local HTML file opened in the tool's embedded browser. Claude Desktop and VS Code restricted the page to its permitted project directory, but the researchers found that the restriction was not enforced inside a web worker, a background script the page could launch. The worker could therefore read files outside the project. Codex had a different weakness: Forever found no equivalent file-read restriction on the page itself, so a direct read could access files beyond the project directory without a worker. In each case, access remained subject to the files the application could read under the user's operating-system permissions.
On their macOS research machine, the team used .DS_Store index files to map directories and automate the reads. The demonstration retrieved SSH keys, .env files, npm tokens, the hosts file and private documents accessible to the user's account. Forever says the proof of concept sent the results to a local test sink; an attacker could instead configure a remote destination.
The file-read attack is not triggered simply by visiting an ordinary website or downloading a project. A person must open the malicious local HTML file in the tool's embedded browser. Forever's demonstration makes that step deceptively ordinary: a project can look like a dull report page, and when the user asks the assistant to set it up from its README, the assistant can present a clickable local-file link. The user still has to click it. That single action opens the page that carries the attack.
The patch record is the second story
Cursor was disclosed on September 10 and, per Forever, silently patched on October 1, with no advisory and no reply to the researchers. GitHub fixed the Copilot spoof independently on October 13, before Forever had sent a report.
The remaining disclosures have different outcomes. Forever says Anthropic initially rejected its Claude Desktop report on July 23, describing it as outside the security boundary protected by Workspace Trust. On July 24, Anthropic accepted a report about the same flaw submitted by Noma Security. Forever's post does not state whether Claude Desktop has since been patched, so its current remediation status cannot be established from this research.
Microsoft, Forever says, rejected its VS Code report on September 10 on similar Workspace Trust grounds. Forever still classified the flaw as unpatched on October 29. OpenAI received the Codex report on July 27; Forever says it received no response and still considered the issue unpatched at publication. The Register separately reported that an OpenAI spokesperson said the company was aware of the issue and working to address it. Awareness and remediation are different things: neither account establishes that a fix had shipped.
The practical concern is not limited to the researchers' test machines. Both products are used in software-development workflows where local project files, credentials and configuration data may be accessible to the application. Until the affected versions are fixed, opening untrusted local HTML in their embedded browsers is an avoidable risk.
What to do with this
Until Codex and VS Code are patched, the cautious move is narrow: do not preview untrusted local HTML files inside these tools, and be sceptical when an assistant hands you a file link from a project you have just downloaded. If you opened an untrusted local HTML file in an affected embedded browser, treat credentials readable by that application as potentially exposed. Follow your organization's incident-response process, including reviewing access logs and rotating or revoking affected SSH keys, API tokens and other credentials where appropriate. Forever reports proof-of-concept demonstrations on the researchers' own machines, not confirmed exploitation against outside users.
Sources
- [1] Forever Security, EMBRACE technical overview, "How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants", October 29, 2026 (primary research, read in full): the per-tool mechanisms, the disclosure timeline (Claude Desktop July 23-24, Codex July 27, Cursor and VS Code September 10), Cursor's silent October 1 patch, and Codex and VS Code still open at publicationRead source
- [2] The Register, "Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched", October 29, 2026, updated October 30 (read in full): an OpenAI spokesperson said the company is aware of the Codex issue and working to address it; Microsoft did not respond to The Register's request for commentRead source
- [3] HackRead, "EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft", October 2026 (secondary coverage)Read source