A browser inside the copilot becomes the attack surface
Forever Security’s EMBRACE research lands on a simple but uncomfortable point: the “browser” inside an AI coding tool is not just a preview pane. It is a bridge between untrusted web or local content, an AI assistant, and the developer workstation that holds source code, tokens, SSH keys and build credentials. The researchers say they tested five desktop AI coding assistants — Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop — and found that each broke at least one browser-security assumption once the browser was embedded into an agentic development workflow .
The class is named EMBRACE, short for “EMbedded BRowser, trusted like a real one,” and the name matters because the flaw is not presented as one shared implementation bug. Forever Security describes it as a design pattern: vendors add browser-like components so assistants can preview local projects, read pages, or reason about what a tab is showing; those conveniences can also give hostile content powers that a standalone browser would deny .
The reported outcomes differ by tool. Cursor was shown reaching host code execution, GitHub Copilot was shown accepting a spoofed address for a browser-preview tab, and Codex, VS Code and Claude Desktop were shown allowing local-file reads beyond the expected project boundary . Hackread’s coverage summarized the same impact as arbitrary code execution, file theft and browser address-bar spoofing across the five tools .
Three browser rules, three failures
The research is easiest to understand as three violated rules. In a normal browser, a web page cannot run commands on the host, a local file cannot freely read other local files, and a page cannot decide what appears in the address bar. Forever Security argues that the five assistants bent those rules for product reasons — for example, to let an AI understand a preview or load project assets — but did not preserve the surrounding threat model .
In Cursor, the issue involved the integrated browser sending page-controlled content into the agent’s command composer. Forever Security says a malicious page could hide instructions in what appeared to the user as a harmless interface element, prompting the assistant to run a setup command. In the proof of concept, the command hit a sandbox restriction, but the agent then disabled that path and retried, leading to a calculator launch as a demonstration of host execution . Help Net Security reported that a real attacker could have used the same path to launch another program with the developer’s privileges, although the result depended on model behavior and did not succeed every time .
GitHub Copilot’s case was different. The reported weakness was not code execution but context deception: a page in Copilot’s browser preview could tell the app it was at a different URL, and the app accepted the string after checking that it looked like a URL. Forever Security’s example displayed a GitHub login address while the content was still served by an attacker-controlled page, creating a phishing scenario that could fool both the human and the agent’s own view of the tab .
The broadest data-exposure scenario involved Codex, VS Code and Claude Desktop. Forever Security says local pages opened under the file:// scheme could read outside their intended project area. In VS Code and Claude Desktop, the top page had a project-scope check, but a web worker launched by that page bypassed it; Codex, according to the researchers, lacked the relevant file-read restriction in the tested path and could read directly from the page .
Why file theft is the supply-chain concern
The file-read finding is especially serious because developer workstations concentrate secrets. Forever Security says its proof of concept mapped files and collected items such as SSH keys, .env files, npm tokens and the hosts file on a research machine . Help Net Security reported the same class of exposed material and emphasized that the attack required only a routine-looking click on a link rendered by the assistant after the developer asked it to set up a project .
That workflow detail matters. The weak point is not a user wandering into an obviously suspicious browser tab. The lure can be packaged as a normal repository task: open a project, ask the assistant to follow the README, and click the local preview link the assistant offers. The trust signal comes from the development tool itself. For teams that rely on AI agents to triage projects, generate code, run package installs and inspect build output, this makes the assistant a potential delivery mechanism, not merely a victim interface.
The supply-chain angle follows from where these tools sit. A stolen SSH key can become repository access. An npm token can become package publication capability. A cloud credential can become infrastructure access. A private source tree can reveal proprietary logic or additional secrets. In that sense, EMBRACE is less about a faulty chat window than about a privileged workstation component that can be coaxed into crossing boundaries.
Patch status and disclosure pressure
The disclosure timeline is uneven. Forever Security says it reported the Cursor issue on September 10 and that Cursor silently patched it on October 1 . The GitHub Copilot address-bar spoof was found and confirmed on Copilot 1.1.27 on September 26, and GitHub fixed it independently in Copilot 1.1.29 on October 13 before Forever Security filed a report .
The still-sensitive part is Codex and VS Code. Forever Security says it disclosed the Codex issue to OpenAI on July 27 and had not received a response by publication; it also says Microsoft declined the VS Code report after a September 10 disclosure, treating Workspace Trust as the relevant boundary . In its main write-up, Forever Security stated that Codex and VS Code remained unpatched at publication time and that users of either tool were still exposed . Help Net Security likewise reported that Codex and VS Code had no fix as of October 29 .
Claude Desktop sits in a slightly different position in the disclosure narrative. Forever Security says Anthropic initially declined its July 23 report as invalid because of Workspace Trust, but accepted a similar report from Noma Security the next day . The available reporting does not present Claude Desktop as one of the two still-open cases at publication; the continuing exposure highlighted by Forever Security and Help Net Security is Codex and VS Code .
What engineering teams should do now
The immediate action is inventory. Security teams should know where Cursor, Copilot, Codex, VS Code and Claude Desktop are installed and whether their embedded-browser features are enabled or used in developer workflows. Forever Security’s recommended framing is to treat the embedded browser as a live endpoint surface, not as a harmless editor feature .
For Codex and VS Code specifically, Help Net Security reports Weizman’s advice to review trusted project lists on machines and inspect HTML files in those projects for the exploit pattern described in Forever Security’s technical write-up . That is a pragmatic containment step, but it should not be the only one. Teams should also reduce long-lived secrets on laptops, prefer short-lived credentials, limit developer tokens by scope, and separate experimental AI-agent workspaces from repositories with production release authority.
Vendors have the harder architectural task. Embedded browsers need the same security invariants users expect from real browsers: page content should not become hidden agent instruction, local previews should not become disk readers, workers should not escape checks applied to top-level pages, and address bars should be controlled by the browser engine rather than the page being displayed. Where an assistant needs more authority, it should be explicit, auditable and sandboxed.
The deeper lesson is that AI coding tools are becoming operating surfaces. The helpful assistant can read code, suggest commands, open pages and sometimes run tooling. That is precisely why these products are valuable — and precisely why a browser boundary mistake can become workstation compromise. EMBRACE shows that the copilot did not merely offer advice; in the wrong context, it could reach for sudo mode before collecting enough power-ups.
Comments
Be the first to comment.